Doubt about Regex on Pipeline

[MrKennedy (Cassio Kennedy)]

Hi people

I’m new about Graylog and I’ve tried to create a Pipeline to extract an information but when I checked the new field created it’s showing (I believe) the index of array…

message: 1/4/2023 12:53:21 PM 3048 PACKET 00000232C6D4D890 UDP Rcv 192.168.251.4 f815 Q [0001 D NOERROR] A (25)atera-agent-heartbeat-cus(10)servicebus(7)windows(3)net(0)

Result

Follow my pipeline script

rule "Get_Domain"
when
    has_field("message")
then
    let message_field = to_string($message.message);
    let domain = regex("(\\([^\\s]+\\))", message_field);
    set_field("dstdomain", domain);
end

I would like to show on this way “dstdomain: (25)atera-agent-heartbeat-cus(10)servicebus(7)windows(3)net(0)”

Anybody could help me?

Have a nice day!!! Thank you

[tmacgbay]

@MrKennedy

let domain = regex("(\\([^\\s]+\\))", message_field);

I think it’s just setting it to find use the first found instance: ["0"]

let domain = regex("(\\([^\\s]+\\))", message_field)["0"];