regex to get only the filename and filedate

[surekhasplunk]

Hi,

My requirement is to show the date when the index got last created or to show the date of the latest file whose data is shown in the dashboard. How can i do that.

My index=bla source="D:\path1\dir1\data_19042018.csv"

i want to extract only the filename into a field filename using rex and also just the date it got indexed that is 19042018 into a field named indexed_date.

How to achieve this

[p_gurav]

Can you try:

| rex field=source "\\(?<filename>\w*\.csv)" 
|rex field=source "\\\w*_(?<indexed_date>[^\.]+)\.csv"

[gcusello · Accepted solution]

Hi surekhasplunk,
try regexes like these:

My_index=bla source="D:\\path1\\dir1\\data_19042018.csv"
| rex field=source "\\(?<filename>\w*\.csv)"
| rex field=source "(?<filename>\d*)\.csv"

as you can test at https://regex101.com/r/ifSjOE/1

Bye.
Giuseppe