Checks whether the given pattern matches any of the values of the array and excludes the event from the search result if it does not match on any value.
Note
To ensure compatibilty, it is recommended to always test your regular expressions inside LogScale, instead of a 3rd party regex tool.
Parameter | Type | Required | Default Value | Description | |
---|---|---|---|---|---|
array [a] | string | required | A string in the format of a valid array index [] . A valid array can either be an identifier, a valid array followed by . and an identifier, or a valid array followed by an array index surrounded by square brackets. For example, for events with fields incidents[0], incidents[1], ... this would be incidents[] . | ||
flags | string | optional[b] | The regex modifier flags to use. | ||
Valid Values | |||||
| Empty String | ||||
d | Period (.) also includes newline characters | ||||
i | Ignore case for matched values | ||||
m | Multi-line parsing of regular expressions | ||||
regex | regex | required | The regex pattern for the value on which to search the array. | ||
[b] Optional parameters use their default value unless explicitly set. |
Hide omitted argument names for this function
Omitted Argument NamesThe argument name for
array
can be omitted; the following forms of this function are equivalent:logscalearray:regex("value[]",regex="value")
and:
logscalearray:regex(array="value[]",regex="value")
These examples show basic structure only.
Hide negatable operation for this function
Negatable Function OperationThis function is negatable, implying the inverse of the result. For example:
logscale!array:regex()
Or:
logscalenot array:regex()
For more information, see Negating the Result of Filter Functions.
A specific syntax applies for this query function, see Array Syntax for details.
array:regex()
Examples
Given events containing an 'incidents' array:
Event 1
|--------------|-------------|
| host | v1 |
| incidents[0] | Evil Bear |
| incidents[1] | Cozy Bear |
|--------------|-------------|
Event 2
|--------------|-------------|
| host | v15 |
| incidents[0] | Fancy Fly |
| incidents[1] | Tiny Cat |
| incidents[2] | Cozy Bears |
|--------------|-------------|
Find all the events where the
incidents field matches the
value Cozy Bear
using a regular
expression, grouping them by which hosts were affected:
array:regex("incidents[]", regex="^Cozy Bear$")
| groupBy(host)
Giving the output event:
|--------------|-------------|
| host | v1 |
| _count | 1 |
|--------------|-------------|
Given events containing a
responses array, find all events
where responses
regex entries ending with
bear
,
BeAr
,
bEAR
, and so on.
array:regex("responses[]", regex="bear$", flags="i")