Hi all,
I have a column containing
Request = REQ_IN ...... { ...... "productId": "test", ...... { ....... "productId": "test2" }}
I have to take the containing value in the first one productId test
I using = | rex field=Request "REQ_IN.*\"productId\"(?<productId_rex>[^,]*)"
but it returns me the second value test2
how can i solve?
Simone
hi @simo,
Command rex captures the first match in the group. Try this:
| makeresults
| eval test="Request = REQ_IN ...... { ...... \"productId\": \"test\", ...... { ....... \"productId\": \"test2\" }}"
| rex field=test "\"productId\":\s*\"(?<productId_rex>[^\"]+)\""
Hi @manjunathmeti
so he is taking the first one, at the beginning I need him to take REQ_IN and so something doesn't work 😞
| makeresults
| eval test="REQ_IN ...... { ...... \"productId\": \"test\", ...... { ....... \"productId\": \"test2\" }}"
| rex field=test "REQ_IN.*\"productId\":\s*\"(?<productId_rex>[^\"]+)\""
Simone
You need to use lazy quantifier (*?B instead of greedy (*) to match as few characters as possible. Try this.
| makeresults
| eval test="REQ_IN ...... { ...... \"productId\": \"test\", ...... { ....... \"productId\": \"test2\" }}"
| rex field=test "REQ_IN.*?\"productId\":\s*\"(?<productId_rex>[^\"]+)\""
If this reply helps you, a like would be appreciated.
@manjunathmeti Looks very similar to my answer from yesterday 🙂
Yes, it is. My bad I was like lazy quantifier 😀
You need to use lazy expansion on the any character, something like:
| rex field=Request "REQ_IN.+?\"productId\":\s(?<productId_rex>[^,]*)"
hi @ITWhisperer
thanks so it goes, but it does not work if the value of productId is only once 😞
simone
I was following your example, but perhaps you could also not extract the quotation marks and use that as the delimiter, rather than the comma, as I suspect that isn't present if there is only one?
| rex field=Request "REQ_IN.+?\"productId\":\s\"(?<productId_rex>[^\"]*)"
Hi @simo
Can you try this regex?
^(?:[^:\n]*:){1}\"(?<productid>\w+)
it's not working 😞
@simo don't worry
try this
^[^:\n]*:\"(?P<productId>\w+)