@@ -39,23 +39,6 @@ rex [mode=<mode>] field=<field> <pattern> [max_match=<int>] [offset_field=<strin
3939* max_match: optional integer (default=1). Maximum number of matches to extract. If greater than 1, extracted fields become arrays.
4040* offset_field: optional string. Field name to store the character offset positions of matches.
4141
42- Named Capture Group Limitations
43- ================================
44- **Important **: Due to Java regex engine limitations, named capture groups cannot contain underscores.
45-
46- **Valid group names: **
47-
48- * ``(?<username>pattern) ``
49- * ``(?<field1>pattern) ``
50- * ``(?<emaildomain>pattern) ``
51-
52- **Invalid group names: **
53-
54- * ``(?<user_name>pattern) `` ← Contains underscore
55- * ``(?<first_initial>pattern) `` ← Contains underscore
56- * ``(?<email_domain>pattern) `` ← Contains underscore
57-
58-
5942Example 1: Basic Field Extraction
6043==================================
6144
@@ -213,23 +196,3 @@ There are several important limitations with the rex command:
213196
214197- Pattern must contain at least one named capture group
215198- Regular capture groups ``(...) `` without names are not allowed
216- - Pattern must use Java regex syntax, not Perl or other flavors
217-
218- **Field Behavior: **
219-
220- - rex automatically filters out events that don't match the pattern
221- - In extract mode, creates new fields from named capture groups
222- - In sed mode, modifies the original field content
223- - When max_match > 1, extracted fields become arrays
224-
225- **Performance Considerations: **
226-
227- - Complex patterns with large max_match values may impact performance
228- - Consider the specificity of patterns to avoid unnecessary processing
229- - Use anchors (^ $) appropriately to improve matching efficiency
230-
231- **Integration: **
232-
233- - Extracted fields can be used in subsequent PPL commands (where, stats, sort, etc.)
234- - sed mode modifications affect the field for subsequent operations
235- - offset_field provides debugging information for pattern matching
0 commit comments