unusual field extraction

[tmarlette]

So these are an examples of the values I want to extract into a field:

ssb4c7ca-c2-00gk

abb4c7ca-c6-00rk

These characters change constantly, and there is also an addition to the end of them from time to time as it passes through our system. e.g.

ssb4c7ca-c2-00gk-1

abb4c7ca-c6-00rk-6

There is no unique character that prefixes, or suffixes this sting of characters, however the only thing unique I have found that is unique is the format of the instance. I have tried using the string \w+.\w+.\w+, however the string is so vague that it extracts random information.

Any ideas on how to extract this data?

[sdaniels · Accepted solution]

You could be very specific about it...something like this will match it. Specifying ranges and then how many characters to expect. Not sure how optimized this would be. Also if you shared your full event data someone might see something to make it easier like a delimiter or something.

Updated:

This should capture both

\w{3}\d\w{1}\d{1}\w{2}-\w\d-\d{2}\w{2}(-\d)?

If the format stays the same but letters and number change positions you could use this:

[0-9a-z]{8}-[0-9a-z]{2}-[0-9a-z]{4}(-[0-9a-z]{1})?

[sdaniels]

Updated above...i think that will work as long as the formatting stays the same..ie 8 - 2 - 4 and sometimes another one on the end.

[tmarlette]

unfortunately the numbers and letters change per character space. The only thing that stays the same, is the formatting of this.

I am bound by security to not make public the rest of the message unfortunately.

What I can tell you is, the logs that this identifier shows up in, are different from each other. I would need to track this ID from system to system, which is why I am attempting to extract it.

Thank you so much!

Travis