getting error for regex "exceeded configured match_limit, consider raising the value in limits.conf"

[vrmandadi]

Below is the regex I am using

|rex field=_raw "\d*\-\d*\s\d*\:\d*\:\d*\.\d*\s(?<Primary_Server>[^\s]+)\s*(?<Primary_DB>[^\s]+)\s*(?<Secondary_Server>[^\s]+)\s*(?<Secondary_DB>[^\s]+)\s*(?<Status>[^\s]+)\s*(?<Last_Backup_File>[^\s]+)\s*(?<Backup_Threshold>[^\s]+)\s*(\d*\-\d*-\d*\s\d*\:\d*\:\d*\.\d*)\s*(?<TimeSinceLastBackup>[^\s]+)\s*(?<Last_Restored_File>[^\s]+)\s*(?<Restore_Threshold>[^\s]+)\s*(\d*\-\d*\-\d*\s\d*\:\d*\:\d*\.\d*)\s*(?<TimeSinceLastRestore>[^\s]+)\s*(?<LastRestoredLatency>[^\s]+)"

Is there a better way to write the regex or should the limits.conf be increased

Thanks in Advance

[darrenfuller · Accepted solution]

First off, you have lots of stars where pluses would do

Second, the pattern seems to match save the last two fields which do not exist in your example event (the data after the date after Restore_Threshold). Should those capture groups have been optional?

Third (this one is completely cosmetic and not functional) I replaced all the [^\s]+ with \S+.

^\d+-\d+-\d+\s\d+\:\d+\:\d+\.\d+\s(?<Primary_Server>\S+)\s+(?<Primary_DB>\S+)\s+(?<Secondary_Server>\S+)\s+(?<Secondary_DB>\S+)\s+(?<Status>\S+)\s+(?<Last_Backup_File>\S+)\s+(?<Backup_Threshold>\S+)\s+(\d+\-\d+-\d+\s\d+\:\d+\:\d+\.\d+)\s+(?<TimeSinceLastBackup>\S+)\s+(?<Last_Restored_File>\S+)\s+(?<Restore_Threshold>\S+)\s+(\d+\-\d+\-\d+\s\d+\:\d+\:\d+\.\d+)\s+((?<TimeSinceLastRestore>\S+)\s+(?<LastRestoredLatency>\S+))?

https://regex101.com/r/1eLLHK/2

[vrmandadi]

Thank You.It worked

[vrmandadi]

https://regex101.com/r/1eLLHK/1

sample event for example