Checks whether the given pattern matches any of the values of the array
and excludes the event from the search result if it does not match on any
value.
Note
To ensure compatibility, it is recommended to always test your regular
expressions inside LogScale, instead of a 3rd party regex tool.
A string in the format of a valid array index []. A valid array can either be an identifier, a valid array followed by . and an identifier, or a valid array followed by an array index surrounded by square brackets. For example, for events with fields incidents[0], incidents[1], ... this would be incidents[] .
A regular expression is a form of advanced searching that looks
for specific patterns, as opposed to certain terms and phrases.
You can use a regular expression to find all matches in an
array. In this example, the regular expression is used to search
for patterns where the value Cozy
Bear appears in a certain position across arrays.
Example incoming data might look like this:
host
incidents[0]
incidents[1]
incidents[2]
v1
Evil Bear
Cozy Bear
v15
Fancy Fly
Tiny Cat
Cozy Bears
v22
Fancy Fly
Tiny Cat
Cold Bears
v4
Fancy Fly
Tiny Cat
Cozy Bearskins
v1
Evil Bear
Cozy Bears
Step-by-Step
Starting with the source repository events.
logscale
array:regex("incidents[]",regex="^Cozy Bear.*")
Searches in the
incidents array for
values that only start with Cozy
Bear. Find all matches given that regular expression.
logscale
|groupBy(host)
Groups the returned results by
host.
Event Result set.
Summary and Results
The query using the regex expression are used to quickly search
and return results for specific values in arrays. Regular
expressions are useful when searching for different strings
containing the same patterns; such as social security numbers,
URLs, email addresses, and other strings that follow a specific
pattern.
Sample output from the incoming example data:
host
_count
v1
2
v15
1
v4
1
Find Matches in Array Given a Regular Expression - Example 2
Use regular expressions to search for and match specific patterns ignoring case in flat arrays
A regular expression is a form of advanced searching that looks
for specific patterns, as opposed to certain terms and phrases.
You can use a regular expression to find all matches in an array.
In this example, the regular expression is used to search for
patterns where the value
bear appears at the end of a
value in an array element, ignoring the case.
Searches in the
responses array for
values that begins with
bear, ignoring the case
(due to the
i flag).
Event Result set.
Summary and Results
The queries using the regex expression are used to quickly
search and return results for specific values in arrays. Regular
expressions are useful when searching for different strings
containing the same patterns; such as social security numbers,
URLs, email addresses, and other strings that follow a specific
pattern.