Search code examples
javaregexloggingregex-lookaroundsgraylog

Graylog Regex Replace Extractor Ungreedy

I'm trying to create a Regex Replace Graylog Extractor that can allow me to get an ID passed as path parameters.

The two cases I need to manage are the followings:

/v1/api2/5eb98050122d484001708a11

/v1/api1/5eb98050122d484001708a11/61b3330151e541232146bfb7/

The ID is always a 24 alphanumerical string.

First case is easy:

^.*([A-Za-z0-9]{24}).*$

First group matches the regex (https://regex101.com/r/Idu5Mp/1).

I need to always match the first ID: 5eb98050122d484001708a11

Also, I need it to match with the first group since in the configuration of the extractor I would use the replacement with $1.

Only solution I could find is to make the Regex Ungreedy, this way the first ID encountered will resolve the regex. Sadly I don't think it's possible to add Regex Flags in Graylog Regex Patterns.

Is there an alternative way to make the regex ungreedy?

Edit: I've also tried the following one without any success. I don't understand why it always gets the second id within the first group.

^.*\/([A-Za-z0-9]{24})(?:\/[A-Za-z0-9]{24})?.*$

Regex shown

Solution

  • You can use

    .*/([A-Za-z0-9]{24,})(?:/.*)?$

    Replace with $1. See the regex demo.

    Details:

    • .* - any zero or more chars other than line break chars as many as possible
    • / - a / char
    • ([A-Za-z0-9]{24,}) - Group 1: 24 or more alphanumeric ASCII chars
    • (?:/.*)? - an optional sequence of / and any zero or more chars other than line break chars as many as possible
    • $ - end of string.