Yes, you can tell the parser to use case insensitivity by supplying the regex parameter of (?i). For example, let's say we have the following log messages:
Line1: The following exception was reported: error in log
Line2: The following exception was reported: Error in log
Line3: The following exception was reported: ERROR in log
Use the following parse regex expression to match the "error" in the logs. The (?i) tells the parser to ignore case for the trailing expression.
| parse regex "reported:\s(?<exception>(?i)error)\s"
This would result in the following parsed fields
exception | Message
ERROR | Line3: The following exception was reported: ERROR in log
Error | Line2: The following exception was reported: Error in log
error | Line1: The following exception was reported: error in log
When aggregating these values you may want to include these as a single result regardless of the casing. In order to do this, you will need to first normalize the strings to a common value using the toLowerCase or toUpperCase operators.
Comments
0 comments
Please sign in to leave a comment.