Regex - Extracting More Than One Entry In Field

Hey Everyone,

We are attempting to extract all of the domains below using the following regex:
DomainName=([-a-zA-Z0-9@:%.+~#=]{1,256}.[a-zA-Z0-9()]{1,6}\b([-a-zA-Z0-9()@:%+.~#?&//=]*))

It will pull the first domain cleanly and give us arc.msn.com, however, we do not get any other domain that is present in the field. Is there a way to tell the regex extractor to pull ALL domains?

Field Contains:
{DomainName=arc.msn.com,RequestType=AAAA}, {DomainName=config.edge.skype.com,RequestType=AAAA}, {DomainName=ntp.msn.com,Request,Type=AAAA}, {DomainName=yahoo.com,RequestType=AAAA}

And what is your final result you want to archive? Field with all domain separated by comma, e.g.:
ntp.msn.com,yahoo.com

1 Like

Hi shoothub, yes, that would be great. Thanks.

Pipeline rule with function regex_replace should works for you:

rule "extract-DomainName"
when
    has_field("field_name")
then
    // replace all occurences
    let fix_url = regex_replace("\\{DomainName=([-a-zA-Z0-9@:%\\.+~#=]+),RequestType=\\w+\\}", to_string($message.field_name), "$1", true);
    set_field("DomainName", fix_url);

    // Optionally remove field
    //remove_field("field_name");
    // Optionally rename one of the field
    //rename_field("field_name", "URLs");
end

Not perfect, but it should work.

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.