Graylog2 / Graylog2/graylog2-server
Not possible to use alternation group before the capture part in an Extractor
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
When creating a regular expression extractor, you can't use an alternation group like `(string1|string2|string3)` followed by the actual capturing group. This is because the first matched group is captured, and a non-capturing ?: at the beginning of the group doesn't work.
## Expected Behavior
For these two seperate log items:
```
CreationEvent by [your_name]
DeletedEvent by [your_name]
```
A regex like `(?:CreationEvent|DeletedEvent).*\[(.*)\]` should correctly capture just "your_name".
Alternatively use a selector to say which captured group is the output.
## Current Behavior
Non-capturing groups don't work, so it just captures the first event group which is not what it desired in this case.
## Possible Solution
Either use or enable the non-capturing group in the regex library, or have a numerical field that dictates which captured group will be taken as the output.
## Context
This makes extractors directly less manageable and useful. It is possible to workaround this by making different extractors for each of the possible values of the first (non) capturing group. This is however cumbersome and less manageable.
## Your Environment
* Graylog Version: 5.1.0-6
* Java Version: openjdk version "17.0.6" 2023-01-17
* OpenSearch Version: 2.7.0
* MongoDB Version: 6.0.6
* Operating System: Ubuntu 20.04 LTS
* Browser version: Firefox
Contributor guide
Assessment
This issue has not been assessed yet.