Could someone help me on this regex? I only want the first part of the data up to "AWSLogs". Example Below:
s3://this-is-bucket-name/test/AWSLogs/123457276024/Config/us-gov-west-1/2019/5/6/ConfigHistory/123457276024_Config_us-gov-west-1_ConfigHistory_AWS::EC2::VPC_20190506T182522Z_20190506T182912Z_1.json.gz
I only need:
s3://this-is-bucket-name/test/AWSLogs
Please find sample
|makeresults
|eval myraw="s3://this-is-bucket-name/test/AWSLogs/123457276024/Config/us-gov-west-1/2019/5/6/ConfigHistory/123457276024_Config_us-gov-west-1_ConfigHistory_AWS::EC2::VPC_20190506T182522Z_20190506T182912Z_1.json.gz"
| rex field=myraw "(?<aws_regex>s3:\/\/.+?\/.+?\/.+?\/)"
| table myraw,aws_regex
demo in regex101 => https://regex101.com/r/KkQkfR/1
Please find sample
|makeresults
|eval myraw="s3://this-is-bucket-name/test/AWSLogs/123457276024/Config/us-gov-west-1/2019/5/6/ConfigHistory/123457276024_Config_us-gov-west-1_ConfigHistory_AWS::EC2::VPC_20190506T182522Z_20190506T182912Z_1.json.gz"
| rex field=myraw "(?<aws_regex>s3:\/\/.+?\/.+?\/.+?\/)"
| table myraw,aws_regex
demo in regex101 => https://regex101.com/r/KkQkfR/1
Hi JPaule,
give this a try:
| makeresults
| eval foo="s3://this-is-bucket-name/test/AWSLogs/123457276024/Config/us-gov-west-1/2019/5/6/ConfigHistory/123457276024_Config_us-gov-west-1_ConfigHistory_AWS::EC2::VPC_20190506T182522Z_20190506T182912Z_1.json.gz"
| rex field=foo "(?<s3BucketName>^s3:\/\/[^\/]+\/[^\/]+\/AWSLogs\/)"
Hope this helps ...
cheers, MuS