Skip to main content
Help Center Logpoint Docs Idea Portal Logpoint.com

I need to extract a field which is not getting normalized as it is part of a combined field. the value of the field is sounded by quote signs, but the process regex command doesn’t seem to get it when I put a backslash before the quote sign. Can I somehow escape the quotes in my regex? 

Example, I want to extract the “from” field value 
 {
    "Directionality": "Incoming",
    "From": "do-not-reply@test-industry.dk",

Wrote the following regex: .*?From\"\:\s*?\"(?P<from>.*?)\" 
but pasting it to | process regex(“.*?From\"\:\s*?\"(?P<from>.*?)\"”, msg) gives error and says “unbalanced quotes” 

From what I understand (although I can’t try it right now), the way to escape double quotes would be to wrap them in single quotes, i.e. ‘”’. And vice versa, escape single quotes by wrapping them in double quotes. The only issue would be if you needed to interpret both at the same time, for which there is a feature request (but I think there has only even been one case so far).

In your specific example, it might save you a few escape quotes to use the norm on command and the definer “quoted” for the field value, but I can’t cobble together a great example at the moment :)

Reply


Terms & ConditionsCookie settings