I had a field of this value
nameSpaces = ["url1"] nameSpaces = ["url1", "url2"]
rex to change
["url1", "url2"] into
However, I am trying to change url1 to a label1, and url2 to label2, is there a way I can change it so the outcome from
"url1, url2" to
I saw I can use rex sed mode, but I am a bit confused on mapping the string. Originally I used spath and then replace for the labels, but I noticed they showed up as single records, and messed up the total count for the logs, so I am trying to maintain the proper length of the array. I was thinking
rex mode=sed "s/url1/label1"
Perfect! what about if I had url1 and url3, and they're both the same, can I somehow condense it to
rex field=nameSpaces mode=sed "s/url1 | url3/label/g" as well as multiple fields?
Thanks! What about
field=nameSpaces|nameSpaces2 mode=sed "s/(ur1|url3)/label/g"? Something similar? I tried that and did not work
You can't specify multiple fields in
field attribute of rex command. You can either run rex multiple time for each nameSpace field, or use foreach command like this
... | foreach nameSpaces* [rex field="<<FIELD>>" mode=sed "s/(url1|url3)/label/g" ]
well technically my nameSpaces are two different fields (name wise), so I guess I am going to have to make duplicate rex lines then, maybe possibly
I accidentally added a space after nameSpace in above foreach command. I'm using
* as wildcard so any field which starts with nameSpace will get that replacement.
And yes, other option would be to add multiple rex commands for each nameSpaceN field.