When I use the [[xdigit]] character class in a parse regex statement, the logs are inconsistently parsed some lines are parsed and some are not, even though the logline content is essentially the same.
| parse regex "\/(?<container_id>[0-9A-Fa-f]+)\["
| parse regex "\/(?<container_id>[[:xdigit:]]+)\["
POSIX bracket expressions are not supported in parse regex. Sumo Logic supports JAVA or RE2 expressions. In the example provided above the first parse regex is supported by Sumo Logic.