Logmanager documentation
Toggle Dark/Light/Auto mode Toggle Dark/Light/Auto mode Toggle Dark/Light/Auto mode Back to homepage

Regex parser

Block used to obtain data from a arbitrary text.

There are two modes of function to choose from:

  • search: returns one result, regular expression is searched only once on the input text,
  • find all: returns more results, regular term is searched repeatedly on the source text.

Arbitrary variable containing text string is connected to the input. Block with regular expression is connected to the “by regex” part. One block “regex match value” can be connected. That block can contain arbitrary count of regular expressions or the expression can be built from individual “regex match value”, “escaped match value” and “regex assign” sub-blocks.

Block XML representation

XML representation of regex_parser block

<xml xmlns="http://www.w3.org/1999/xhtml">
  <block type="regex_parser">
    <field name="PARSE">SEARCH</field>
    <value name="VAR">
      <block type="text">
        <field name="TEXT">input value</field>
      </block>
    </value>
    <value name="REGEX">
      <block type="regex_match_escaped">
        <field name="MATCH">regex</field>
      </block>
    </value>
  </block>
</xml>

Example of visual representation

Block "Search by regex"

Block “Search by regex”

Example of block usage

Example of "Search by regex" block

Example of “Search by regex” block

Block is used on the “set item to” row in the example:

  • data from key “raw” from the “message” dictionary are on the input,
  • these data are processed by regular expressions defined in the “by regex” part,
  • output of the block is stored into dictionary called “item”.

Input data

Login permitted from 192.168.10.1/1234 to inside:192.168.1.1/https for user admin

Processing result

Results of "Search by regex" block

Results of “Search by regex” block