i have a field with several strings like
fieldname = AT-field2-field3
fieldname = DE-field2
fieldname = DE-field2-field3-field4
etc...
I try to get a rex to just get the country code:
|rex field=fieldname "^(?<country>.*)-.*"
but the result is not just the Country Code
any ideas?
The .* operator is greedy so it will grab as many characters as it can that still match the expression. One solution is to use the non-greedy quantifier.
|rex field=fieldname "^(?<country>.*?)-.*"
Another solution is to take everything up to the first hyphen. Like this:
| rex field=fieldname "^(?<country>[^-]+)-"
The .* operator is greedy so it will grab as many characters as it can that still match the expression. One solution is to use the non-greedy quantifier.
|rex field=fieldname "^(?<country>.*?)-.*"
Another solution is to take everything up to the first hyphen. Like this:
| rex field=fieldname "^(?<country>[^-]+)-"
thank you for your input. Both variants work and i learned something new 🙂