Regular Expression Flags
LogScale regular expressions can be modified by flags that change the default behaviour of the regular expression engine. The following flags are supported:
d
In a regular expression, the
.
(period) character matches any standard (non-escape) characters including newline. When using this flag, the.
will match any character, including the newline.You can combine with the
m
flag so that.
matches any character, but still allows^
and$
to match the beginning end of lines within a multi-line string.g
Match the same expression multiple times within a single event. This can be used to extract repeated elements when assigning to a field:
logscalecompany = /(?<orgname>\w+):/g
Or when extracting multiple values to a named field:
i
Case-insensitive searching, matching values regardless of the case of the characters.
m
Standard processing of the value against a regular expression matches only a line. This treats the incoming string as having multiple lines, which means the
^
and$
special characters to match the start and end of the entire string, not individual lines within the string.
Using Regular Expression Flags
To use a flag within LogScale depends on whether you are using
/regex/
or regex()
:
Using
regex()
You can use the
flags
argument to theregex()
function to set the flags for a regular expression. For example:logscaleregex("orgname",flags="i")
Would enable case-insensitive matching so that the regular expression will match
orgname
,ORGNAME
ororgName
.Using
regex()
You can use the
flags
argument to thearray:regex()
function to set the flags for a regular expression execution over an array. For example:logscalearray:regex("host[]", "host1", flags="i")
Using
/regex/
You can append flags after the
/
delimiter. For example:logscale/orgname/i
Would match
orgname
,ORGNAME
ororgName
, or any combination of upper and lower case letters for the word "orgname".Using flags extension within
/regex/
Flag settings can be embedded into the regular expression using the
(?flags)
extension:logscale/(?i)orgname/
Would match
orgname
,ORGNAME
ororgName
, or any combination of upper and lower case letters for the word "orgname".The flags can also be used to explicitly match a string, for example:
logscale/(?i:orgname)extension/
Applies the case insensitive flag only to
orgname
, whileextension
would remain case sensitive, matchingorgnameextension
,ORGNAMEextension
ororgNameextension
, but notorgNameExtension
.