rex help

[darkins]

probably an easy one, i have two events as follows

thisisfield1 thisisfield2 mynextfield3

thisisfield1 mynextfield3

meaning in some events field2 exists, in some it doesnt, when it does i want the value and when it doesnt i want it to be blank and all records have mynextfield3 and i always want that as field3

i want rex these lines and end up with

field1               field2              field3

thisisfield1    thisisfield2   mynextfield3

thisisfield1                              mynextfield3

[PickleRick]

It all depends how your fields are delimited/anchored. @marnall 's answer is obvious if you have just two or three words separated by spaces. If your "layout" is different, you have to adjust it.

[gcusello]

Hi @darkins ,

could you share some samples of your logs, highlighting the strings to extract?

Ciao.

Giuseppe

[darkins]

not sure what else to put, this is what my data looks like

thisisfield1 thisisfield2 mynextfield3

thisisfield1 mynextfield3

i want these two lines to display as

field1               field2              field3

thisisfield1    thisisfield2   mynextfield3

thisisfield1                              mynextfield3

[gcusello]

Hi @darkins ,

ad also @PickleRick and @marnall said, the regex depends on the log, so it's difficoult to create a regex without some sample.

If you have three words, separated by a space and somethimes there are only two words without any other rule, it's not possible to define a regex; if instead there's some additional rule in the firstfields or in the nextfield, it's possible to identify a regex.

Ciao.

Giuseppe

[darkins]

i guess the key is i think i need to say that field2 equals everything up to an m PRECEDED by a space?

[PickleRick]

The thing is that regex must match your data properly so we can't just "assume" something out of the blue.

You can fiddle with the regex for yourself (and see how and why it works)

https://regex101.com/r/VaY5Qn/1

[marnall]

Assuming that field1 and field3 are always at the beginning and end of the line respectively, and assuming that their values do not contain spaces, and assuming they are separated by spaces, you could use this:

^(?<field1>\S+)\s*(?<field2>\S+)?\s(?<field3>\S+)$