Match a String Against Regex in Pipeline Processors

GTownson · August 16, 2017, 11:29am

rule "TargetWorkstation"
when
to_string($message.TargetUserName)regex("(.*)\$", TargetUserName)
then
rename_field("TargetUserName", "TargetWorkstationName");
end

Hi guys, above you can see my attempt at matching a string with regex in a pipeline processor.
My aim is when the field TargetUserName ends with a dollar sign I would like the change the field name to TargetWorkstationName, I am just not sure how to match the field against the regex.

Regards,
George

jochen · August 21, 2017, 2:24pm

You can access the boolean matches property of the result:

github.com

Graylog2/graylog-plugin-pipeline-processor/blob/2.3.0/plugin/src/test/resources/org/graylog/plugins/pipelineprocessor/functions/regexMatch.txt#L3


rule "regexMatch"
when
regex("^.*(cde\\.)(:(\\d+))?.*$", "abcde.fg").matches == true &&
regex(".*(cde\\.)(:(\\d+))?.*", "abcde.fg").matches == true &&
regex("(cde\\.)(:(\\d+))?", "abcde.fg").matches == true &&
regex("^(cde\\.)(:(\\d+))?$", "abcde.fg").matches == false
then
let result = regex("(cd\\.e)", "abcd.efg");
set_field("group_1", result["0"]);
let result = regex("(cd\\.e)", "abcd.efg", ["name"]);
set_field("named_group", result["name"]);
set_field("matched_regex", result.matches);
end

system · September 4, 2017, 2:24pm

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Matching Field Contents with Regex (Pipeline Processing) Graylog Central (peer support)	7	6651	October 26, 2017
Pipelines and regex (and some extractor talk) Graylog Central (peer support) regex-special-charac	6	778	July 11, 2023
Regex in Search Field Graylog Central (peer support)	6	1420	September 20, 2018
Regex Matching in Pipeline or Extractor Graylog Central (peer support)	18	2295	January 31, 2023
Regex works in search but not in Stream Graylog Central (peer support) pipeline-rules	6	534	July 22, 2021

Match a String Against Regex in Pipeline Processors

Related topics