Regex (Regular Expression) Filter - Ironstream_Hub - ironstream_for_splunk - ironstream_for_elastic - ironstream_for_kafka - 1.3

Ironstream Hub Administration

Product type
Software
Portfolio
Integrate
Product family
Ironstream
Product
Ironstream > Ironstream for Splunk®
Ironstream > Ironstream for Kafka®
Ironstream > Ironstream Hub
Ironstream > Ironstream for Elastic®
Version
1.3
Language
English
ContentType
Administration
Product name
Ironstream Hub
Title
Ironstream Hub Administration
First publish date
2022
ft:lastEdition
2024-08-07
ft:lastPublication
2024-08-07T14:51:48.776141

With a Regex filter, you can define a regular expression to pass or not to pass data that is more powerful than the simple filter. A Regex Filter is similar to a Simple Filter but with this you can perform more complex searching and matching.

For more information about the regular expressions, and to build and test them, see https://regex101.com.

To add a Regex Filter, click the Regex Filter in the Add Process window. The canvas updates immediately to show the empty filter.

Specifying the Regular expression

All parts of the Regular expression are case-sensitive. For example, ‘PRODUCTION’, ‘Production’ and ‘production’ are all considered as different strings, and “STATUS”:”OK” and “Status”:”OK” will be considered as two different strings.

Example: To look for a string that contains “ERRORCODE”:” followed by a number, you can enter a regular expression of “ERRORCODE”:\d. \d string identifies “a number”.

If your regular expression is incorrect, you will get the notification as you move away from the field in the bottom panel. For example, here the final ‘d’ character is missing:
Figure 1. Incorrect Regular Expression