"matches" operator not working when the pattern repeats inside the string?


1 comment

  • Avatar
    Latimer Luis

    I THINK it might be a bug, yes. I was able to verify this behavior on my end.

    As a workaround, you can use the following instead of the matches operator, since parsing data also acts as a filter when the NODROP clause isn't used. 

    | parse regex field=cache "(?<cache>.*HIT)"

    I hope this helps. 

    Comment actions Permalink

Please sign in to leave a comment.