regextract

Learn more about the Cortex Query Language regextract() function that uses regular expressions to assemble an array of matching substrings from a string.

Syntax

regextract (<string_value>, <pattern>)

Description

The regextract() function accepts a string and a regular expression, and it returns an array containing substrings that match the expression.

Cortex Query Language (XQL) uses RE2 for its regular expression implementation. While capturing multiple groups is unsupported, capturing one group in queries is supported.

When using the (?i) syntax for case-insensitive mode in your query, this syntax should be added only once at the beginning of the inline regular expression.

Note

Capturing multiple groups is supported in Parsing Rules when using the regexcapture function.

Examples

Without a capturing group

Extract the Account Name from the action_evtlog_message. Use the arrayindex and split functions to extract the actual account name from the array created by regextract.

dataset = xdr_data 
| fields action_evtlog_message as aem 
| filter aem != null 
| alter account_name = 
    arrayindex(
        split(
            arrayindex(
                regextract(aem, "Account Name:\t\t.*\r\n")
            ,0)
        , ":")
    ,1) 
| filter account_name != null 
| limit 10 

Using one capturing group

Extract from the log_example field all of the values included for the id objects.

dataset = xdr_data 
| limit 1
| alter
    log_example = "{\"events\":[{\"id\": \"1\", \"type\": \"process\", \"size\": 123, \"processID\": 40540},{\"id\": \"2\", \"type\": \"request\", \"size\": 456, \"srcOS\": \"MAC\"}],\"host\": \"LocalHost\",\"date\": {\"day\": 4, \"month\": 7, \"year\": 2024},\"tags\":[\"agent\", \"auth\", \"low\"]}"
| alter 
    one_capture_group_usage = regextract(log_example, "\"id\":\s*\"([^\"]+)\"")
| fields log_example, one_capture_group_usage