extracting the value from the match of the "regex" command

[darrend]

Hi Guys

I have an objective to trawl our data to ensure it is clean of sensitive data for compliance purposes.

I started by using a regex as follows:

index=* | regex "\b4[0-9]{12}(?:[0-9]{3})?\b"

This gives me lots of positive hits, by if a boolean response, yes it matches or no it doesn't, what i want it to extract the matched value to an interesting field to then do some post processing to validate if the number matched passes an LUHN check, this will get rid of more false positives and reduce the number to, hopefully zero responses.

I looked at rex, but from what i can see and my experience that seems to want you to populate the variable you want to extract in the middle of the regex, what i want is more, match this regex and put the match into an interesting field.

Is there something that i am missing to achieve this easily?

Thanks
Darren

[abpe]

In props.conf define an EXTRACT to create your field.

EXTRACT-statement = (?Pyour regex)

Then in transforms.conf use the SOURCE_KEY to do another regex match on that particular field.

SOURCE_KEY = your_field

REGEX = ...

FORMAT = result_field::$1 result_field2::$2

[abpe]

You can pipe two rex statements if you prefer:
| rex field=your_field "(?your regex)" | rex field=new_field "(?your regex)"

[darrend]

Hi,

This is great, but is there are a way to do it from a runtime search rather than messing with the configuration?

Thanks
Darren