# Help wirh Regular expression Extractor

**URL:** <https://community.graylog.org/t/help-wirh-regular-expression-extractor/19103>\
**Category:** Graylog Central (peer support)\
**Created:** [March 12, 2021, 1:50pm UTC](https://community.graylog.org/t/help-wirh-regular-expression-extractor/19103 "2021-03-12T13:50:08Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![amendoza](https://avatars.discourse-cdn.com/v4/letter/a/f17d59/32.png) [@amendoza](https://community.graylog.org/u/amendoza)\
**Post date:** [March 12, 2021, 1:50pm UTC](https://community.graylog.org/t/help-wirh-regular-expression-extractor/19103/1 "2021-03-12T13:50:08Z")

</div>

Hello everyone,

I have this example messages:

- (3)www(10)easycoloso(3)com(0)\*
- (6)cmgrau(3)com(0)\*
- (12)settings-win(4)data(9)microsoft(3)com(0)\*
- (3)ens(4)rest(3)gti(6)mcafee(3)com(0)\*

**And I need a result like:**

- [www.easycoloso.com](http://www.easycoloso.com)
- [cmgrau.com](http://cmgrau.com)
- [settings-win.data.microsoft.com](http://settings-win.data.microsoft.com)
- [ens.rest.gti.mcafee.com](http://ens.rest.gti.mcafee.com)

So **I need to delete the first and last () with numbers inside but replace the () in the middle by dots**. Any help?

Thanks in advance

---

<div class="post-metadata">

**Author:** ![ttsandrew](https://avatars.discourse-cdn.com/v4/letter/t/97f17d/32.png) [@ttsandrew](https://community.graylog.org/u/ttsandrew)\
**Post date:** [March 12, 2021, 10:32pm UTC](https://community.graylog.org/t/help-wirh-regular-expression-extractor/19103/2 "2021-03-12T22:32:56Z")

</div>

What are you using? A replace with regular expression extractor?

Search expression:

```
\([0-9]*\)

```

Replace with

```
.

```

Do you also want to remove the trailing \*?

```
\([0-9]*\)\**

```

Make sure to check replace all occurrences.

You can practice and tweak regex with any number of sites, personally I like RegExr.

---

<div class="post-metadata">

**Author:** ![ttsandrew](https://avatars.discourse-cdn.com/v4/letter/t/97f17d/32.png) [@ttsandrew](https://community.graylog.org/u/ttsandrew)\
**Post date:** [March 12, 2021, 10:42pm UTC](https://community.graylog.org/t/help-wirh-regular-expression-extractor/19103/3 "2021-03-12T22:42:45Z")

</div>

Oh, I misread, you want to remove leading and trailing. That’s going to be 2 filters, for example the one provided above and then this one:

```
^\.*|\.*$

```

But there are other combinations.

---

<div class="post-metadata">

**Author:** ![amendoza](https://avatars.discourse-cdn.com/v4/letter/a/f17d59/32.png) [@amendoza](https://community.graylog.org/u/amendoza)\
**Post date:** [March 15, 2021, 8:04am UTC](https://community.graylog.org/t/help-wirh-regular-expression-extractor/19103/4 "2021-03-15T08:04:19Z")

</div>

Thank you Andrew,

It is something like this 2 steps:

^([0-9]_)|([0-9]_)$ -------------\> To remove the first and last ()  
And  
([0-9]\*) --------------\> To replace the () in the middle with dots

I don’t know if I can do this in one extractor.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [March 29, 2021, 8:04am UTC](https://community.graylog.org/t/help-wirh-regular-expression-extractor/19103/5 "2021-03-29T08:04:43Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.