Skip to content

Extract multiple regex patterns from a log #1161

Answered by jszwedko
jrosado48 asked this question in Q&A
Extract multiple regex patterns from a log #1161
@jrosado48 jrosado48
Dec 2, 2024 · 1 comments · 4 replies
Answered by jszwedko Return to top
Discussion options

jrosado48
Dec 2, 2024

You must be logged in to vote
Answered by jszwedko Dec 3, 2024

Thanks for sharing the additional examples! When I use your remap I do see multiple events being emitted.

Configuration:

sources:
  source0:
    type: stdin
    decoding:
      codec: json
transforms:
  transform0:
    type: remap
    inputs:
    - source0
    source: |
      str = string(.message) ?? ""
      .value = parse_regex_all(str, r'(?P<value>\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}\.\d{6}.*\|\|\s*)|(?P<value2>Number_PRSDUP:\s*\d+\s+Avg_QTime:\s*\d+\.\d{3}\s+Max_Parallel:\s*\d+\s+Parallel_Idle_time:\s*\d+\.\d{3}\s+Delete_Alert:\s*\d+(?:\s+Delete_Alert_failures:\s*\d+)?)') ?? {}

      newval = []
      for_each(.value) -> |_, item| {
        if item.value != null {
          newval = …
View full answer

Replies: 1 comment 4 replies

Comment options

jszwedko
Dec 2, 2024
Maintainer

You must be logged in to vote
4 replies
@jrosado48
Comment options

jrosado48 Dec 2, 2024
Author

@jrosado48
Comment options

jrosado48 Dec 2, 2024
Author

@jszwedko
Comment options

jszwedko Dec 3, 2024
Maintainer

Answer selected by jrosado48
@jrosado48
Comment options

jrosado48 Dec 3, 2024
Author

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Category
Q&A
Labels
vrl: stdlib Changes to the standard library
2 participants
@jrosado48 @jszwedko