Regexing error only in pipelines


(Oidz1234) #1

Hallo,

I am trying write a pipeline to match a field in a log message.

I have confirmed the regex works by using the extractor regex tester. However I would rather a pipeline then an extractor.

I am getting many errors in the below:
rule “function match phonenum”

when
has_field("api_call")

then

let tg_message = to_string($message.message)

let g_message = regex("phonenum\/(.*)\?", $tg_message);

I am trying to match any number of characters after the string “phonenum” up to a literal “?” However the pipeline editor is throwing many token condition errors.

Once again I have verified that the regex works using the extractor functionality. So I assume my regex function syntax must be incorrect. Is anyone able to help ?

Thanks !


(Oidz1234) #2

Managed to solve this, I had to format the regex as a “Java string”

Before "phonenum\/(.*)\?"
after "phonenum\\/(.*)\\?"


(system) #3

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.