@@ -32,15 +32,14 @@ Extract username and domain from email addresses using named capture groups. Bot
3232
3333PPL query::
3434
35- os> source=accounts | rex field=email "(?<username>[^@]+)@(?<domain>[^.]+)" | fields email, username, domain | head 3 ;
36- fetched rows / total rows = 3/3
37- +--------------------------+--------------+---------+
38- | email | username | domain |
39- |--------------------------+--------------+---------|
40- | amberduke@pyrami.com | amberduke | pyrami |
41- | hattiebond@netagy.com | hattiebond | netagy |
42- | nanettebates@quility.com | nanettebates | quility |
43- +--------------------------+--------------+---------+
35+ os> source=accounts | rex field=email "(?<username>[^@]+)@(?<domain>[^.]+)" | fields email, username, domain | head 2 ;
36+ fetched rows / total rows = 2/2
37+ +-----------------------+------------+--------+
38+ | email | username | domain |
39+ |-----------------------+------------+--------|
40+ | amberduke@pyrami.com | amberduke | pyrami |
41+ | hattiebond@netagy.com | hattiebond | netagy |
42+ +-----------------------+------------+--------+
4443
4544
4645Example 2: Handling Non-matching Patterns
@@ -50,17 +49,14 @@ The rex command returns all events, setting extracted fields to null for non-mat
5049
5150PPL query::
5251
53- os> source=accounts | rex field=email "(?<user>[^@]+)@(?<domain>gmail\\.com)" | fields email, user, domain | head 5 ;
54- fetched rows / total rows = 5/5
55- +---------------------------+----------+--------+
56- | email | user | domain |
57- |---------------------------|----------|--------|
58- | amberduke@pyrami.com | null | null |
59- | hattiebond@netagy.com | null | null |
60- | nanettebates@quility.com | null | null |
61- | daleadams@boink.com | null | null |
62- | elinorross@syntac.com | null | null |
63- +---------------------------+----------+--------+
52+ os> source=accounts | rex field=email "(?<user>[^@]+)@(?<domain>gmail\\.com)" | fields email, user, domain | head 2 ;
53+ fetched rows / total rows = 2/2
54+ +-----------------------+------+--------+
55+ | email | user | domain |
56+ |-----------------------+------+--------|
57+ | amberduke@pyrami.com | null | null |
58+ | hattiebond@netagy.com | null | null |
59+ +-----------------------+------+--------+
6460
6561
6662Example 3: Multiple Matches with max_match
@@ -72,13 +68,13 @@ PPL query::
7268
7369 os> source=accounts | rex field=address "(?<words>[A-Za-z]+)" max_match=2 | fields address, words | head 3 ;
7470 fetched rows / total rows = 3/3
75- +--------------------+------------------- +
76- | address | words |
77- |--------------------|- ------------------|
78- | 880 Holmes Lane | [Holmes, Lane] |
79- | 671 Bristol Street | [Bristol, Street] |
80- | 789 Madison Street | [Madison, Street] |
81- +--------------------+------------------- +
71+ +--------------------+------------------+
72+ | address | words |
73+ |--------------------+ ------------------|
74+ | 880 Holmes Lane | [Holmes,Lane] |
75+ | 671 Bristol Street | [Bristol,Street] |
76+ | 789 Madison Street | [Madison,Street] |
77+ +--------------------+------------------+
8278
8379
8480Example 4: Complex Email Pattern
@@ -88,15 +84,14 @@ Extract comprehensive email components including top-level domain. All extracted
8884
8985PPL query::
9086
91- os> source=accounts | rex field=email "(?<user>[a-zA-Z0-9._%+-]+)@(?<domain>[a-zA-Z0-9.-]+)\\.(?<tld>[a-zA-Z]{2,})" | fields email, user, domain, tld | head 3 ;
92- fetched rows / total rows = 3/3
93- +--------------------------+--------------+---------+-----+
94- | email | user | domain | tld |
95- |--------------------------+--------------+---------+-----|
96- | amberduke@pyrami.com | amberduke | pyrami | com |
97- | hattiebond@netagy.com | hattiebond | netagy | com |
98- | nanettebates@quility.com | nanettebates | quility | com |
99- +--------------------------+--------------+---------+-----+
87+ os> source=accounts | rex field=email "(?<user>[a-zA-Z0-9._%+-]+)@(?<domain>[a-zA-Z0-9.-]+)\\.(?<tld>[a-zA-Z]{2,})" | fields email, user, domain, tld | head 2 ;
88+ fetched rows / total rows = 2/2
89+ +-----------------------+------------+--------+-----+
90+ | email | user | domain | tld |
91+ |-----------------------+------------+--------+-----|
92+ | amberduke@pyrami.com | amberduke | pyrami | com |
93+ | hattiebond@netagy.com | hattiebond | netagy | com |
94+ +-----------------------+------------+--------+-----+
10095
10196
10297Example 5: Chaining Multiple rex Commands
@@ -110,7 +105,7 @@ PPL query::
110105 fetched rows / total rows = 3/3
111106 +-----------+----------+--------------+-------------+
112107 | firstname | lastname | firstinitial | lastinitial |
113- |-----------| ----------| --------------| -------------|
108+ |-----------+ ----------+ --------------+ -------------|
114109 | Amber | Duke | A | D |
115110 | Hattie | Bond | H | B |
116111 | Nanette | Bates | N | B |
@@ -125,19 +120,19 @@ Demonstrates naming restrictions for capture groups. Group names cannot contain
125120Invalid PPL query with underscores::
126121
127122 os> source=accounts | rex field=email "(?<user_name>[^@]+)@(?<email_domain>[^.]+)" | fields email, user_name, email_domain ;
128- Error: Rex pattern must contain valid named capture group names. Group names cannot contain underscores.
123+ {'reason': 'Invalid Query', 'details': 'Rex pattern must contain at least one named capture group', 'type': 'IllegalArgumentException'}
124+ Error: Query returned no data
129125
130126Correct PPL query without underscores::
131127
132- os> source=accounts | rex field=email "(?<username>[^@]+)@(?<emaildomain>[^.]+)" | fields email, username, emaildomain | head 3 ;
133- fetched rows / total rows = 3/3
134- +--------------------------+--------------+-------------+
135- | email | username | emaildomain |
136- |--------------------------+--------------+-------------|
137- | amberduke@pyrami.com | amberduke | pyrami |
138- | hattiebond@netagy.com | hattiebond | netagy |
139- | nanettebates@quility.com | nanettebates | quility |
140- +--------------------------+--------------+-------------+
128+ os> source=accounts | rex field=email "(?<username>[^@]+)@(?<emaildomain>[^.]+)" | fields email, username, emaildomain | head 2 ;
129+ fetched rows / total rows = 2/2
130+ +-----------------------+------------+-------------+
131+ | email | username | emaildomain |
132+ |-----------------------+------------+-------------|
133+ | amberduke@pyrami.com | amberduke | pyrami |
134+ | hattiebond@netagy.com | hattiebond | netagy |
135+ +-----------------------+------------+-------------+
141136
142137
143138Comparison with Related Commands
0 commit comments