A regular expression (regex) is a pattern-matching string used to search for, extract, or validate text based on matching rules. LogScale supports standard regex syntax for powerful text manipulation and filtering operations.

Regular expressions can include literal characters, special metacharacters for matching patterns (such as . for any character, * for repetition, ^ for start of line, $ for end of line), character classes, capture groups, and quantifiers. Regex patterns are typically specified as string values within function parameters.

Additional flags can modify regex behavior, such as i for case-insensitive matching. For example, regex="^Cozy Bear.*" matches strings starting with "Cozy Bear", while regex="bear$", flags="i" matches strings ending with "bear" in any case combination.

For more information on regular expression syntax and usage, see Regular Expression Syntax.

regex(field=message, regex="^ERROR")

regex(field=filename, regex="\.log$")

regex(field=hostname, regex="server", flags="i")

regex(field=email, regex="(?<username>[^@]+)@(?<domain>.+)")

regex(field=text, regex="\\b(?:[0-9]{1,3}\\.){3}[0-9]{1,3}\\b")

Functions using this Type: array:regex(), dropEvent(), eval(), fieldset(), regex(), replace(), splitString()