Regular Expression Flags

LogScale regular expressions can be modified by flags that change the default behaviour of the regular expression engine. The following flags are supported:

  • d

    In a regular expression, the . (period) character matches any standard (non-escape) characters including newline. When using this flag, the . will match any character, including the newline.

    You can combine with the m flag so that . matches any character, but still allows ^ and $ to match the beginning end of lines within a multi-line string.

  • g

    Match the same expression multiple times within a single event. This can be used to extract repeated elements when assigning to a field:

    logscale
    company = /(?<orgname>\w+):/g

    Or when extracting multiple values to a named field:

  • i

    Case-insensitive searching, matching values regardless of the case of the characters.

  • m

    Standard processing of the value against a regular expression matches only a line. This treats the incoming string as having multiple lines, which means the ^ and $ special characters to match the start and end of the entire string, not individual lines within the string.

Using Regular Expression Flags

To use a flag within LogScale depends on whether you are using /regex/ or regex():

  • Using regex()

    You can use the flags argument to the regex() function to set the flags for a regular expression. For example:

    logscale
    regex("orgname",flags="i")

    Would enable case-insensitive matching so that the regular expression will match orgname, ORGNAME or orgName.

  • Using regex()

    You can use the flags argument to the array:regex() function to set the flags for a regular expression execution over an array. For example:

    logscale
    array:regex("host[]", "host1", flags="i")

  • Using /regex/

    You can append flags after the / delimiter. For example:

    logscale
    /orgname/i

    Would match orgname, ORGNAME or orgName, or any combination of upper and lower case letters for the word "orgname".

  • Using flags extension within /regex/

    Flag settings can be embedded into the regular expression using the (?flags) extension:

    logscale
    /(?i)orgname/

    Would match orgname, ORGNAME or orgName, or any combination of upper and lower case letters for the word "orgname".

    The flags can also be used to explicitly match a string, for example:

    logscale
    /(?i:orgname)extension/

    Applies the case insensitive flag only to orgname, while extension would remain case sensitive, matching orgnameextension, ORGNAMEextension or orgNameextension, but not orgNameExtension.