Regular Expression Flags
LogScale regular expressions can be modified by flags that change the default behaviour of the regular expression engine. Flags supported are:
d
In a regular expression, the
.
(period) character matches any standard (non-escape) characters including newline. When using this flag, the.
will match any character, including the newline.You can combine with the
m
flag so that.
matches any character, but still allows^
and$
to match the beginning end of lines within a multi-line string.g
Match the same expression multiple times within a single event. This can be used to extract repeated elements when assigning to a field:
logscalecompany = /(?<orgname>\w+):/g
Or when extracting multiple values to a named field:
i
Case-insensitive searching, matching values regardless of the case of the characters.
m
Standard processing of the value against a regular expression matches only a line. This treats the incoming string as having multiple lines, which means the
^
and$
special characters to match the start and end of the entire string, not individual lines within the string.
Using Regular Expression Flags
Usage of flag within LogScale depends on whether you are using
/regex/
or regex()
:
Using
regex()
You can use the
flags
argument to theregex()
function to set the flags for a regular expression. For example:logscaleregex("orgname",flags="i")
Would enable case-insensitive matching so that the regular expression will match
orgname
,ORGNAME
ororgName
.Using
regex()
You can use the
flags
argument to thearray:regex()
function to set the flags for a regular expression execution over an array. For example:logscalearray:regex("host[]", "host1", flags="i")
Using
/regex/
You can append flags after the
/
delimiter. For example:logscale/orgname/i
Would match
orgname
,ORGNAME
ororgName
, or any combination of upper and lower case letters for the word "orgname".Using flags extension within
/regex/
Flag settings can be embedded into the regular expression using the
(?flags)
extension:logscale/(?i)orgname/
Would match
orgname
,ORGNAME
ororgName
, or any combination of upper and lower case letters for the word "orgname".The flags can also be used to explicitly match a string, for example:
logscale/(?i:orgname)extension/
Applies the case insensitive flag only to
orgname
, whileextension
would remain case sensitive, matchingorgnameextension
,ORGNAMEextension
ororgNameextension
, but notorgNameExtension
.