Hey there!
I am currently having some trouble in converting a flattened multivalue field back into a real multivalue field.
I know that there are easy ways with multi value field commands. However I need to do this via regex in this specific case.
So the _raw is looking like this
06/23/2019 11:59:32 +0000, lotsofrandomstuff="lotsofrandomstuff",interestingIds="1234 2345 56784", lotsofotherrandomstuff="lotsofotherrandomstuff"
However I just cannot get it to work.
If I just take the field interestingIds and extract it from there its fairly easy and working:
| rex field=_raw max_match=100 "(?<Ids>\d*)\s?"
But as soon as I set the beginning (interestingIds=”) and the end (“), I only ever get one value, either the first or the last. Or of course all in the same format as before, but not as multivalue.
Get the same field:
| rex field=_raw "interestingIds=\"(?<Ids>((\d)|(\s))*)\".*"
Other stuff I tried:
This only takes the first value
| rex field=_raw max_match=100 "interestingIds=((\"|\s)(?\d+)(\"|\s))*.*"
This one only takes the last value (which kind of means that the value is overwritten each time I guess)
| rex field=_raw max_match=100 " interestingIds=\"((?<Ids>\d+)\s?)*\".*"
This one only gives the very last digit:
| rex field=_raw max_match=100 " interestingIds=\"(\d+\s?)*(?<Ids>\d+)(\s?\d+)*\".*"
You can replace the first * with a ? to get the second segment or a {2} to get the third segment, but it’s only one segment then.
So maybe you have an idea on how to make it work.
Update:
So my next idea was to not focus on the stuff I want to take away, but to filter out everything else, hoping that the Front and Rear Anchor would work:
| rex field=_raw max_match=0 "^(.*interestingIds=)(\"|(.*\s))(?<Ids>\d+)(\"|(\s.*))(, lotsofotherrandomstuff=.*)$"
| rex field=_raw max_match=0 "^(.*interestingIds=\")(?<Ids>\d+)(\", lotsofotherrandomstuff=.*)$"
Unfortunately both options do not work.
It seems like as soon as you specify any kind of position, it fails.
... View more