Regex in DQL

Frazzle — Tue, 25 Mar 2025 12:36:13 GMT

Is it possible to filter a contents of a log for a particular set of letters using regex?
Example is that we are looking for any contents that have EX****S where the * are random numbers.

MatchesPhrase does not work exactly as we would expect. As shown below the filter will get the log lines we want but also other log lines where the *S matches.

| filter matchesPhrase(content, " EX*") and matchesPhrase(content, "*S ")

Are we able to use regex to match for any numbers between the set of letters we're looking for?

Re: Regex in DQL

marco_irmer — Tue, 25 Mar 2025 13:35:47 GMT

Pure Regex is not an option currently. However, you can use the matchesPattern() function in a filter to match against events which patch a particular DPL pattern. In the example code below, we're looking for the equivalent the following of regex pattern: .*EX\d{4}S.*

| filter matchesPattern(content,"LD? 'EX' DIGIT{4} 'S' LD?")

topic Re: Regex in DQL in DQL

Regex in DQL

Re: Regex in DQL