Graylog2 / Graylog2/graylog2-server

Not possible to use alternation group before the capture part in an Extractor

Open
#15,937 1 comment 0 reactions 0 assignees View on GitHub
bug triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

When creating a regular expression extractor, you can't use an alternation group like `(string1|string2|string3)` followed by the actual capturing group. This is because the first matched group is captured, and a non-capturing ?: at the beginning of the group doesn't work.

## Expected Behavior

For these two seperate log items:
```
CreationEvent by [your_name]
DeletedEvent by [your_name]
```
A regex like `(?:CreationEvent|DeletedEvent).*\[(.*)\]` should correctly capture just "your_name".
Alternatively use a selector to say which captured group is the output.

## Current Behavior

Non-capturing groups don't work, so it just captures the first event group which is not what it desired in this case.

## Possible Solution

Either use or enable the non-capturing group in the regex library, or have a numerical field that dictates which captured group will be taken as the output.

## Context

This makes extractors directly less manageable and useful. It is possible to workaround this by making different extractors for each of the possible values of the first (non) capturing group. This is however cumbersome and less manageable.

## Your Environment

* Graylog Version: 5.1.0-6
* Java Version: openjdk version "17.0.6" 2023-01-17
* OpenSearch Version: 2.7.0
* MongoDB Version: 6.0.6
* Operating System: Ubuntu 20.04 LTS
* Browser version: Firefox

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.