Important

This function is considered experimental and under active development and should not be used in production.

The function must be enabled using the feature flag ArrayFunctions. See Enabling/Disabling Features.

Checks whether the given pattern matches any of the values of the array and excludes the event from the search result if it does not match on any value. Capturing groups are currently only supported for numbered back-referencing.

ParameterTypeRequiredDefaultDescription
arraystringtrue The prefix of the array in Humio, for example for events with fields 'incidents[0], incidents[1], ...' this would be 'incidents'.
flagsstringfalse The regex flags to use: `i` for case-insensitive match; `m` for multi-line matching; and `d` makes `.` include newlines.
regexstringtrue The regex pattern for the value on which to search the array.

Examples

Given events containing an 'incidents' array:

Event 1

humio
|--------------|-------------|
| host         | v1          |
| incidents[0] | Evil Bear   |
| incidents[1] | Cozy Bear   |
|--------------|-------------|

Event 2

humio
|--------------|-------------|
| host         | v15         |
| incidents[0] | Fancy Fly   |
| incidents[1] | Tiny Cat    |
| incidents[2] | Cozy Bears  |
|--------------|-------------|

Find all the events where 'incidents' regex the exact value 'Cozy Bear' and group them by which hosts were affected, giving output event

humio
|--------------|-------------|
| host         | v1          |
| _count       | 1           |
|--------------|-------------|
humio
array:regex(incidents, pattern="^Cozy Bear$") |
groupBy(host)

Given events containing a 'responses' array, find all events where 'responses' regex entries ending with 'bear', 'BeAr', 'bEAR', and so on.

humio
array:regex(responses, pattern="bear$", flags="i")