simple email regex

[kleckns]

Ive been trying most of the regex solutions on this forum, but cant get any of them to work. Im trying to extract emails into a new field without any of the extra junk

field value needs regex:
 "John Doe" <[email protected]>

search:
    ... | rex field=from "(?<from>(?<=<)[^>]+)" | table from, other fields, etc...

im looking for [email protected] without any quotes or gt/lt characters around it in the from field

[somesoni2 · Accepted solution]

This should do it.

... | rex field=from "(\<|\;)(?<from>[^\>\;]+)" | table from, other fields, etc...

[kleckns]

your regex worked great. Part of the problem was a dumb mistake on my part. i had switched the fields around in the field=email_from "(<|\;)(?[^>\;]+)"

the orig field that had the values is email_from, not from. i wanted to create a new field called from... so i had it backwards.

Thank you for the regex!