Return Group1 from regex not fullmatch

Hi,

I'm pretty new to both ELK and Filebeat. I'm trying to get a custom field built using a regex value. I'm having to use javascript which seems to be complicating things. I have the following regex .com/([A-Za-z0-9]+)/ it returns .com/clientname/ as a fullmatch and clientname as the group one match. The group 1 match is the desired match for the custom field. Is there a way to do that. Below is what I have in the filebeat yml.

processors:

  • script:
    lang: javascript
    id: clientid_regex
    source: >
    function process(event) {
    var cid;
    var message;
    message=event.Get("message");
    if ( cid = message.match(/.com/([A-Za-z0-9]+)//) ) {
    event.Put("rcm.clientid", cid);
    }
    }

Hi @quixter, welcome to the Elastic Community Forums!

To extract groups in Javascript I think you'll want to use RegExp.prototype.exec() instead of String.prototype.match(). See https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Regular_Expressions/Groups_and_Ranges#Using_groups for an example.

Hope that helps,

Shaunak

Hi and thanks for the reply. I will explore tat and see if I can figure it out. Been pretty bad at this thing called coding so far. :slight_smile:

Eh, I'm sure you're doing fine. Computers are hard, and Javascript is harder :wink:.

Please post here if you can't get it working. We're here to help!

Shaunak

I was able to use groups to return it correctly. Simply added [2].

    message=event.Get("message");
    if ( cid = message.match(/.(com)\/([A-Za-z0-9]+)\//)  ) {
      event.Put("rcm.clientid", cid[2]);