Matching Field Contents with Regex (Pipeline Processing)

(GT) #1

I am trying my hand at pipeline processing, but once again it just confuses me and I get nowhere with it!

So below I will include sudo code of what I am trying to achieve:

    field: TargetUserName exists
        field: TargetUserName matches regex: "\\$$" (This regex matches field values that end with $)
        set field name: TargetUserName    to    TargetWorkstationName

(Jochen) #2

There are no conditionals (like if-then-else) in the rule language, so you have to put these things into the “when” block.

Other than that, the usage of the has_field(), regex(), and set_field() functions should be reasonably straight forward.

(GT) #3

Could you provide me with the code to match the field ‘TargetUserName’ with the regex \$$

I really struggle to understand the syntax behind the pipeline processors, and usually choose to not use them where possible. I have read multiple forum posts and all of the documentation surrounding them, however I still can’t seem to get them working, to a point where it’s worth it over using streams and extractors to solve issues I have.



(Jochen) #4

See for some example usages of the regex() function.

The regular expression syntax follows the rules of Java regular expressions:

(GT) #5

Hi Jochen,

I have been pointed to this page before, I still don’t understand it. I’m not sure if this is just me or if other users struggle with pipeline processing. Looking at that page, I don’t understand what each line is doing I feel that it could be more clearly documented.

Thank you for the Regex links, they are useful.




Maybe this will help:

rule "a_rule"
   has_field("a_field") AND to_bool(regex("^0$",to_string($message.somefield)).matches)
   //do whatever you want here

I think another way is to do this step by step in pipeline eg.

step 0 contains the field
step 1 matches regex + change name (only if step one passes)

I agree, documentation is a bit shallow

(Jan Doberstein) #7

I agree, documentation is a bit shallow

Additions and clarifications can be submitted as PR to the Repository and we welcome every contribution.

(system) closed #8

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.