When I use the [[xdigit]] character class in a parse regex statement, the logs are inconsistently parsed some lines are parsed and some are not, even though the logline content is essentially the same.
For example:
| parse regex "\/(?<container_id>[0-9A-Fa-f]+)\["
| parse regex "\/(?<container_id>[[:xdigit:]]+)\["
POSIX bracket expressions are not supported in parse regex. Sumo Logic supports JAVA or RE2 expressions. In the example provided above the first parse regex is supported by Sumo Logic.
Comments
0 comments
Please sign in to leave a comment.