Search code examples
regexrubyfluentd

Named capturing group to different names


I'm working on a logging stack based on Banzai Cloud ClusterFlow, we've a log that is currently parsed with a regular expression and placed in a specific name; however we would like to deprecate that name and replace it with a new one, let's say the pattern is just like the following one:

^(?<someName>[^ ]*) (?<someNameWeWishToDeprecate>[^ ]*)$

supposing we receive a log line such as

prop1 prop2

it will produce two properties in our parsed log:

someName=prop1
someNameWeWishToDeprecate=prop2

What we would like to obtain is instead

someName=prop1
someNameWeWishToDeprecate=prop2
someNewFancyNae=prop2

As you can see we'd like to keep the old name but also have the new one; is this possible by elaborating the regular expression?

FYI: the regular expression engine is ruby-based


Solution

  • You can nest the named capturing groups and use

    ^(?<someName>[^ ]*) (?<someNewFancyNae>(?<someNameWeWishToDeprecate>[^ ]*))$
    

    Or,

    ^(?<someName>\S+)\s+(?<someNewFancyNae>(?<someNameWeWishToDeprecate>\S+))$
    

    See the regex demo.

    enter image description here