regex (Invalid regex: no named extraction at position 5 )

[broman]

I have problem with saving regex for extracting class name
Here is my regex

(?i)\[([0-9a-zA-Z\.\s\-]&ast;(\[[0-9]&ast;\])?[0-9a-zA-Z\.\s\-\/]&ast;)\]\s(?P<FIELDNAME>[^ ]+)

And here is log sample
12.02.2015 12:14:16.946 INFO [10.36.27.187 [1423743256597] GET /content/company/global/en/company/notices/polish.html HTTP/1.1] com.company.web.core.cdn.CDNTransformer CDN: http://static-dc.company.net
12.02.2015 14:17:03.340 INFO [pool-5-thread-3] org.apache.jackrabbit.core.state.SharedItemStateManager Validating change-set hierarchy

And here is splunk error
"Invalid regex: no named extraction at position 5 (i.e., "[([0-9a-zA..."). Expected "(?P<variable>pattern)""

[richgalloway · Accepted solution]

This regex string works with your example log entries on regex101.com. It also handles nested brackets.

\[.*\]\s(?P<FIELDNAME>[^ ]+)

[broman]

Thanks 😄

[richgalloway]

The forward slash needs to be escaped.

You have nested capturing groups. Is that intentional?

[broman]

in some log lines I have nested [] so I try to handle this in regex.

[cphair]

You'll need to fix the formatting on your regex so it displays properly in the browser; we can't read it as is. Edit your question and substitute & # 92; (with no spaces) for all the backslashes.

[broman]

done, thanks for notice