Grok match to last index unti begin of UserAgent


(Khaleid Lund) #1

Hi all
I have message

"sid-cmascioieiow89322&New*Sou,th%20Skvn%20and%20ir&o,n%20Age,Mozilla/5.0 (Linux; Android 6.0; CHM-U01 Build/HonorCHM-U01) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.98 Mobile Safari/537.36"

and the pattern
"(?[^&])&(?[^,]),%{GREEDYDATA:User_Agent}"

the problem is p2 some time contains zero or one or more then one comma i want to match to the last comma before UserAgent because UserAgent some time contains comma

now

{
"p1": [
"sid-cmascioieiow89322"
],
"p2": [
"New*Sou"
],
"User_Agent": [
"th%20Skvn%20and%20iro,n%20Age,Mozilla/5.0 (Linux; Android 6.0; CHM-U01 Build/HonorCHM-U01) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.98 Mobile Safari/537.36"
]
}
I want like this

{
"p1": [
"sid-cmascioieiow89322"
],
"p2": [
"New*Sou,th%20Skvn%20and%20ir&o,n%20Age"
],
"User_Agent": [
"Mozilla/5.0 (Linux; Android 6.0; CHM-U01 Build/HonorCHM-U01) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.98 Mobile Safari/537.36"
]
}

thank you for help


(system) #2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.