I am building extractors to parse an alarmlog with comma separated fields.
Depending on field values I need to use a a different extractor. So I use the only execute extractor if regex is true field.
However that is easy if you would like e.g. if the string starts with “someword”, but complicated if you need to check the value of a certain field.
So I hope someone can help. What I need is the following:
- assume the input string / field is like this ,,,, etc
- I want to check the value of field “3”
- and I want to check if the content is ‘fruit’
- or want to check the opposite want to check if the content <>‘fruit’
As described the intention is that the regex de terms if the extractor should run.
PS I would love to see an extractor run check based on a previously extracted field, but that option is not there