The extraction failed. If you are extracting multiple fields, try removing one or more fields. Start with extractions that are embedded within longer text strings.
Highlight one or more values in the sample event to create fields. You can indicate one value is required, meaning it must exist in an event for the regular expression to match. Click on highlighted values in the sample event to modify them. To highlight text that is already part of an existing extraction, first turn off the existing extractions. Learn more
Feb 14 14:44:18 exnet-01a.intechnologywifi.com local1 events: EventType[Area Change] MAC[00:B3:62:BE:8E:B7] Details: Area[SS1 - CCTV193 - Eastern Esplanade]
Feb 10 13:56:29 exnet-01a.intechnologywifi.com local1 events: EventType[Area Change] MAC[A4:E4:B8:6E:DD:D2] Details: Area[SS1 - Leigh On Sea Community Centre]
Here is a solution to the regex, which considers the middle
- somestring to be optional:
As for why your regex caused that error, you'd need to post the regex you used for anyone to give you an answer.
Updated link that also grabs the middle value:
It was just a case of adding a named capture group for the portion of the optional group up until the space.
that's solved it thanks. how would I extract the previous field which may or may not exist in the string ie. CCTV193 in this case
Edited my answer with a new link to meet that need.
excellent thanks - I'd nearly worked it out!