1

I'm trying to create a Regex Replace Graylog Extractor that can allow me to get an ID passed as path parameters.

The two cases I need to manage are the followings:

/v1/api2/5eb98050122d484001708a11

/v1/api1/5eb98050122d484001708a11/61b3330151e541232146bfb7/

The ID is always a 24 alphanumerical string.

First case is easy:

^.*([A-Za-z0-9]{24}).*$

First group matches the regex (https://regex101.com/r/Idu5Mp/1).

I need to always match the first ID: 5eb98050122d484001708a11

Also, I need it to match with the first group since in the configuration of the extractor I would use the replacement with $1.

Only solution I could find is to make the Regex Ungreedy, this way the first ID encountered will resolve the regex. Sadly I don't think it's possible to add Regex Flags in Graylog Regex Patterns.

Is there an alternative way to make the regex ungreedy?

Edit: I've also tried the following one without any success. I don't understand why it always gets the second id within the first group.

^.*\/([A-Za-z0-9]{24})(?:\/[A-Za-z0-9]{24})?.*$

Regex shown

Xfox
  • 174
  • 2
  • 10
  • `5eb98050122d484001708a11f` is 25 chars long. Try `.*\/([A-Za-z0-9]{24})(?:\/.*)?$` / `.*/([A-Za-z0-9]{24})(?:/.*)?$` – Wiktor Stribiżew Dec 06 '22 at 19:02
  • I've tried it but it seems it's not working: https://regex101.com/r/K6lC1r/1 regex101.com said there were errors with the char `/` I've also tried on the Graylog interface where it is possible to test. – Xfox Dec 06 '22 at 22:52
  • No ideas how you failed to copy and paste the pattern. There **two** patterns separated with `/` in the top comment. The real test is at https://regex101.com/r/K6lC1r/2 Also, you need to show how you are using the regex in the target environment. – Wiktor Stribiżew Dec 07 '22 at 08:41
  • But I don't need two patterns. I need one that matches in both cases and encloses into group 1 the onlye id in the first string and the first id in the second string. I'm running the test in the graylog interface for Extractor creation. – Xfox Dec 07 '22 at 09:15
  • The two patterns are the same (just `/` is unescaped in the second version). So it is basically one pattern. The first string you provided contains a 25-char substring, not 24. So your requirements are not clear: is that 24- OR 25-char string you are looking for? – Wiktor Stribiżew Dec 07 '22 at 09:34
  • Sorry, I've corrected. Both are 24 – Xfox Dec 07 '22 at 09:55
  • So, if it is really Java regex flavor, the `.*/([A-Za-z0-9]{24})(?:/.*)?$` regex will work. – Wiktor Stribiżew Dec 07 '22 at 10:03

1 Answers1

1

You can use

.*/([A-Za-z0-9]{24,})(?:/.*)?$

Replace with $1. See the regex demo.

Details:

  • .* - any zero or more chars other than line break chars as many as possible
  • / - a / char
  • ([A-Za-z0-9]{24,}) - Group 1: 24 or more alphanumeric ASCII chars
  • (?:/.*)? - an optional sequence of / and any zero or more chars other than line break chars as many as possible
  • $ - end of string.
Wiktor Stribiżew
  • 607,720
  • 39
  • 448
  • 563
  • It should always match `5eb98050122d484001708a11`, but it doesn't – Xfox Dec 11 '22 at 12:24
  • @Xfox You are changing the requirements on the fly. The solution is the same, just ADJUST the quantifier - here you have 23 chars. Just use `.*/([A-Za-z0-9]{20,})(?:/.*)?$` - https://regex101.com/r/K6lC1r/6 – Wiktor Stribiżew Dec 11 '22 at 12:28