Skip to content

matches - Check if string matches a regex

The matches function will check if a given string matches a regular expression. The regular expression will check the whole string. If it matches, then this function returns true, otherwise it will return false.

Syntax

matches(string: string, regexp: regexp): bool

Arguments

Name Type Required Description
string string true The string to test
regexp regexp true The regular expression to test against the string

Example - Finding malformed fields

Fields in your logs may not follow a specific, desired format. We can use the matches function to find all documents with malformed fields.

Consider the following documents:

{
    "msg_structured": "User Chris bought 10 Sunglasses"
},
{
    "msg_structured": "User James bought 1 Bed"
},
{
    "msg_structured": "User X bo"
}

We can see that the 3rd document has been truncated, and the msg_structured field is incomplete. We can use matches to single this out, like so:

filter !msg_structured.matches(/User [a-z|A-Z]+ bought \d+ [a-z|A-Z]+/)

Try it yourself

Paste the following command into your explore screen:

create msg_structured from 'User Chris bought 10 Sunglasses'
| filter !msg_structured.matches(/User [a-z|A-Z]+ bought \d+ [a-z|A-Z]+/)