I need to extract a field which is not getting normalized as it is part of a combined field. the value of the field is sounded by quote signs, but the process regex command doesn’t seem to get it when I put a backslash before the quote sign. Can I somehow escape the quotes in my regex?
Example, I want to extract the “from” field value
{
"Directionality": "Incoming",
"From": "do-not-reply@test-industry.dk",
Wrote the following regex: .*?From\"\:\s*?\"(?P<from>.*?)\"
but pasting it to | process regex(“.*?From\"\:\s*?\"(?P<from>.*?)\"”, msg) gives error and says “unbalanced quotes”
Using quotes " in process regex command?
Userlevel 3
+8
Userlevel 4
+7
From what I understand (although I can’t try it right now), the way to escape double quotes would be to wrap them in single quotes, i.e. ‘”’. And vice versa, escape single quotes by wrapping them in double quotes. The only issue would be if you needed to interpret both at the same time, for which there is a feature request (but I think there has only even been one case so far).
In your specific example, it might save you a few escape quotes to use the norm on command and the definer “quoted” for the field value, but I can’t cobble together a great example at the moment :)
Reply
Sign up
Already have an account? Login
Already a Partner or Customer? Login with your LogPoint Support credentials. Don‘t have a LogPoint Support account? Ask your local LogPoint Representative. Only visiting? Login with LinkedIn to gain read–access.
LOGIN AS PARTNER OR CUSTOMER Login with LinkedInLogin to the community
Already a Partner or Customer? Login with your LogPoint Support credentials. Don‘t have a LogPoint Support account? Ask your local LogPoint Representative. Only visiting? Login with LinkedIn to gain read–access.
LOGIN AS PARTNER OR CUSTOMER Login with LinkedInEnter your username or e-mail address. We'll send you an e-mail with instructions to reset your password.