matches - Check if string matches a regex
The matches
function will check if a given string matches a regular expression. The regular expression will check the whole string. If it matches, then this function returns true
, otherwise it will return false
.
Syntax
Arguments
Name | Type | Required | Description |
---|---|---|---|
string | string | true | The string to test |
regexp | regexp | true | The regular expression to test against the string |
Example - Finding malformed fields
Fields in your logs may not follow a specific, desired format. We can use the matches
function to find all documents with malformed fields.
Consider the following documents:
{
"msg_structured": "User Chris bought 10 Sunglasses"
},
{
"msg_structured": "User James bought 1 Bed"
},
{
"msg_structured": "User X bo"
}
We can see that the 3rd document has been truncated, and the msg_structured
field is incomplete. We can use matches
to single this out, like so:
Try it yourself
Paste the following command into your explore screen:
create msg_structured from 'User Chris bought 10 Sunglasses'
| filter !msg_structured.matches(/User [a-z|A-Z]+ bought \d+ [a-z|A-Z]+/)
Theme
Light