# Regular expression

**URL:** <https://community.graylog.org/t/regular-expression/6018>\
**Category:** Graylog Central (peer support)\
**Created:** [July 18, 2018, 1:46pm UTC](https://community.graylog.org/t/regular-expression/6018 "2018-07-18T13:46:07Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![alban](https://avatars.discourse-cdn.com/v4/letter/a/858c86/32.png) [@alban](https://community.graylog.org/u/alban)\
**Post date:** [July 18, 2018, 1:46pm UTC](https://community.graylog.org/t/regular-expression/6018/1 "2018-07-18T13:46:07Z")

</div>

Hi,

I need help to find a regular expression.

NG\_Firewall[]: 1531920798 1 xxxxx dddddd [toto]

I need to obtain result betwin character []  
How can i do ?

Regards

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [July 18, 2018, 4:21pm UTC](https://community.graylog.org/t/regular-expression/6018/2 "2018-07-18T16:21:03Z")

</div>

Please provide more than 1 example for the messages you’re trying to process.  
It’s very likely that a regular expression matching that single example you gave won’t match any other messages.

Maybe you could also use some pre-defined Grok patterns simplify extracting the information you’re looking for.

---

<div class="post-metadata">

**Author:** ![sojip](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/sojip/32/810_2.png) [@sojip](https://community.graylog.org/u/sojip)\
**Post date:** [July 20, 2018, 12:17pm UTC](https://community.graylog.org/t/regular-expression/6018/3 "2018-07-20T12:17:33Z")

</div>

Hello. Sorry for my english i don’t speak it well. I have the same problem. i’m looking for a regex to extract a value. I have a field containing informations in this form:

What: \192.168.100.36\dossier1\path\to\a\file.txt  
What: \192.168.100.36\dossier2\path2\to2\a2\file2.txt  
What: \192.168.100.36\dossier3\path3\to3\a3\file3.txt

I will like to extract the values “dossier1”, “dossier2” and “dossier3” in another field but can’t find a good regex. Can you help me please?

---

<div class="post-metadata">

**Author:** ![alban](https://avatars.discourse-cdn.com/v4/letter/a/858c86/32.png) [@alban](https://community.graylog.org/u/alban)\
**Post date:** [July 20, 2018, 1:48pm UTC](https://community.graylog.org/t/regular-expression/6018/4 "2018-07-20T13:48:07Z")

</div>

Hi,

French too 🙂  
Maybe you can use “split & index” extractor.  
Your Split by can be “” character

Regards

---

<div class="post-metadata">

**Author:** ![alban](https://avatars.discourse-cdn.com/v4/letter/a/858c86/32.png) [@alban](https://community.graylog.org/u/alban)\
**Post date:** [July 20, 2018, 1:48pm UTC](https://community.graylog.org/t/regular-expression/6018/5 "2018-07-20T13:48:45Z")

</div>

\ character sorry 🙂

---

<div class="post-metadata">

**Author:** ![sojip](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/sojip/32/810_2.png) [@sojip](https://community.graylog.org/u/sojip)\
**Post date:** [July 20, 2018, 4:05pm UTC](https://community.graylog.org/t/regular-expression/6018/6 "2018-07-20T16:05:43Z")

</div>

Hi,  
if i use \ character for “split & index” i extracts either “What:” or “192.68.100.36\dossier1\path\to\a\file.txt”.  
if there is a another mean to use split & index please inform me.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [August 3, 2018, 4:05pm UTC](https://community.graylog.org/t/regular-expression/6018/7 "2018-08-03T16:05:45Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.