Hallo,
I am trying write a pipeline to match a field in a log message.
I have confirmed the regex works by using the extractor regex tester. However I would rather a pipeline then an extractor.
I am getting many errors in the below:
rule “function match phonenum”
when
has_field("api_call")
then
let tg_message = to_string($message.message)
let g_message = regex("phonenum\/(.*)\?", $tg_message);
I am trying to match any number of characters after the string “phonenum” up to a literal “?” However the pipeline editor is throwing many token condition errors.
Once again I have verified that the regex works using the extractor functionality. So I assume my regex function syntax must be incorrect. Is anyone able to help ?
Thanks !