Why doesn't rex sed work with this expression: s/=[^&]*//g

[danapsimer]

I have used rex to extract a URL from log message. I then want to eliminate the parameter values so I can build statistics based on the URL. To do this I use the following rex command:

rex field=request_url mode=sed "s/=[^&]*//g"

With the following input:

/UsomCustomer/customers?storeNumber=####&phone=##########

I get:

/UsomCustomer/customers?storeNumber

but I expect

/UsomCusteomr/customers?storeNumber&phone

When I execute sed locally with the same expression and the same input it works.

$  sed 's/=[^&]*//g' < test-sed.txt
/UsomCustomer/customers?storeNumber&phone 

One curious thing is that when I take away the second rex command and look at the "request_url" field in the UI. I see '\u0026' instead of & in the display.

[gcusello]

Hi danapsimer,
try something like

| rex field=request_url "^(?<url>[^\?]*)"

Bye.
Giuseppe

[cpetterborg]

When I run the following, it get what you are expecting:

| makeresults 
| eval url="/UsomCustomer/customers?storeNumber=####&phone=##########"
| rex field=url mode=sed "s/=[^&]*//g"

which is:

/UsomCustomer/customers?storeNumber&phone

It does look like you have a character issue in the search string.