Failing syntax in regex within pipeline

I’m having trouble saving a Rule within a pipeline. I’m attempting to pull the TestID and TestName from a message and insert them into new fields. The Rule will not save stating a failed to Post (500) error.
Test threads did not complete within the max testing duration limit for test group IRM - DNS as of 3/28/2019 2:47:51 PM

Emt Service will attempt to abort threads:
Test ID Threads Active:

Here’s the rule
rule “EMT: Generate TestID and TestName fields”
has_field(“Instance_Failing”) == “true”
let message_field = to_string($message.message);
let ID_Name = regex("(\w+)-(\w+)-(\w+)-(\w+)-(\w+)|(\w+)", to_string($message.message_field));
let TestID_TestName = split("|", value: ID_Name,);
let TestID = TestID_TestName[0];
let TestName = TestID_TestName[1];
set_field(“Instance_TesID”, Instance_TestID);
I’ve tried with the following syntax nad it fails as well, but without any errors.

let ID_Name = regex(pattern: “[a-zA-Z0-9]±[a-zA-Z0-9]±[a-zA-Z0-9]±[a-zA-Z0-9]±[a-zA-Z0-9]+|[a-zA-Z0-9]+”, value: message_field, );

Thanks for your help.

for me it is not clear how your message field looks - that is why I can’t help. But if you assign the variable message_field with to_string($message.message) you need to use only message_fieldonly in the next line. As this contains already to_string($message.message).

do you need to format your regex as a java string ?


instead of


do you need to format your regex as a java string ?

yes - that is true too.

After I removed the split function and related variables. It worked! Thank you.

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.