Regex - Extracting More Than One Entry In Field

Hey Everyone,

We are attempting to extract all of the domains below using the following regex:

It will pull the first domain cleanly and give us, however, we do not get any other domain that is present in the field. Is there a way to tell the regex extractor to pull ALL domains?

Field Contains:
{,RequestType=AAAA}, {,RequestType=AAAA}, {,Request,Type=AAAA}, {,RequestType=AAAA}

And what is your final result you want to archive? Field with all domain separated by comma, e.g.:,

1 Like

Hi shoothub, yes, that would be great. Thanks.

Pipeline rule with function regex_replace should works for you:

rule "extract-DomainName"
    // replace all occurences
    let fix_url = regex_replace("\\{DomainName=([-a-zA-Z0-9@:%\\.+~#=]+),RequestType=\\w+\\}", to_string($message.field_name), "$1", true);
    set_field("DomainName", fix_url);

    // Optionally remove field
    // Optionally rename one of the field
    //rename_field("field_name", "URLs");

Not perfect, but it should work.

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.