Regex returning unintended sting

[nsookhoo]

I am attempting to use the regex function to extract the status code from a message. The status code is always prefaced with: “GET /”, for e.g:
21 -0500] “GET /” 401 381

I have the following as a rule in my pipeline:
let status = regex(“GET\\s\\/.\\s([0-9]{3})”,to_string($message.message));
set_field(“Status”, status);

However, I get the following as the status:
{“0”:“401”}

instead of “GET/” 401

I tested the regular expression on https://regexr.com, and it matches the string correctly. I also read this post: Regex pipeline : Get IP from string field, which informed me to escape the “\” characters.

Are there any other quirks to the regex pattern?

[Ponet (Jesse Hills)]

Hi @nsookhoo

You could try this and see if it works for you:

Regex: ^.*\"\s(\d{3})

I’ve tested the above against the example you provided in your original post and it appears to parse as intended.

Let me know if it works for you.

Thanks.

[nsookhoo]

Thanks for the reply.
I simply cut and pasted the expression but there was some syntax error:

[Ponet (Jesse Hills)]

Please provide the error that is being produce

[nsookhoo]

[macko003]

Use double escape ín pipeline

[Ponet (Jesse Hills)]

Hi again @nsookhoo

Just got back onto my dev system and checked.

The pipeline rule editor doesn’t appear to complain with this regex: ^.*\"\\s(\\d{3})

You can try that however, if that produces strange results, you can also try: ^.*\\\"\\s(\\d{3})

Thanks.