Help wirh Regular expression Extractor

Graylog Central (peer support)
1

Hello everyone,

I have this example messages:

  • (3)www(10)easycoloso(3)com(0)*
  • (6)cmgrau(3)com(0)*
  • (12)settings-win(4)data(9)microsoft(3)com(0)*
  • (3)ens(4)rest(3)gti(6)mcafee(3)com(0)*

And I need a result like:

So I need to delete the first and last () with numbers inside but replace the () in the middle by dots. Any help?

Thanks in advance

2

What are you using? A replace with regular expression extractor?

Search expression:

\([0-9]*\)

Replace with

.

Do you also want to remove the trailing *?

\([0-9]*\)\**

Make sure to check replace all occurrences.

You can practice and tweak regex with any number of sites, personally I like RegExr.

3

Oh, I misread, you want to remove leading and trailing. That’s going to be 2 filters, for example the one provided above and then this one:

^\.*|\.*$

But there are other combinations.

4

Thank you Andrew,

It is something like this 2 steps:

^([0-9])|([0-9])$ -------------> To remove the first and last ()
And
([0-9]*) --------------> To replace the () in the middle with dots

I don’t know if I can do this in one extractor.

5

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.