{"id":52880,"date":"2022-03-17T12:52:11","date_gmt":"2022-03-17T12:52:11","guid":{"rendered":"https:\/\/merikebi.warrenmyers.com\/?p=52880"},"modified":"2022-03-17T12:52:11","modified_gmt":"2022-03-17T12:52:11","slug":"answer-by-warren-for-regular-expression-for-url-query-params-that-differ-in-size-order-and-topic","status":"publish","type":"post","link":"https:\/\/merikebi.warrenmyers.com\/?p=52880","title":{"rendered":"Answer by warren for regular expression for url query params that differ in size, order and topic"},"content":{"rendered":"

It sounds<\/em> like you want to extract as many key-value pairs as there may be in the query portion of a URL<\/p>\n

If<\/em> this is correct, here’s a way to approach it:<\/p>\n

index=ndx sourcetype=srctp url=*\n| eval query=split(url,"?")\n| eval query=mvindex(query,-1)\n| rex field=query max_match=0 "(?<pair>[^&]+)"\n| mvexpand pair\n<\/code><\/pre>\n
Alternatively, if you have a reason to want to split them out\/change the =<\/code> to, say, a |<\/code>:<\/p>\n
index=ndx sourcetype=srctp url=*\n| eval query=split(url,"?")\n| eval query=mvindex(query,-1)\n| rex field=query max_match=0 "(?<key>[^=]+)\\=(?<value>[^=]+)"\n| eval pair=mvzip(key,value," | ")\n| mvexpand pair\n<rest of search>\n<\/code><\/pre>\n
By running split<\/code><\/a> on the URL against the ?<\/code> character, you’ll get the base URL and the query string (if there is any)<\/p>\n
Selecting the last index in the multivalue field (via mvindex<\/code><\/a>), you’ll get just<\/em> the query string, unless there was no query string, in which case you’ll get the base URL. If there were no query present, the first regular expression will return the entire URL as the pair<\/code> field, and the second rex<\/code> call should return nothing (since it won’t find an =<\/code> sign in the URL).<\/p>\n
By using max_match<\/code> with rex<\/code><\/a>, you’ll get back a [possibly] multivalue field of results<\/p>\n
Since all arguments in a URL query string have to be separated with a &<\/code>, this should work across most examples<\/p>\n
from User warren – Stack Overflow https:\/\/stackoverflow.com\/questions\/71511990\/regular-expression-for-url-query-params-that-differ-in-size-order-and-topic\/71512596#71512596
\nvia IFTTT<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
It sounds like you want to extract as many key-value pairs as there may be in the query portion of a URL If this is correct, here’s a way to approach it: index=ndx sourcetype=srctp url=* | eval query=split(url,"?") | eval query=mvindex(query,-1) | rex field=query max_match=0 "(?<pair>[^&]+)" | mvexpand pair Alternatively, if you have a reason …
Continue reading Answer by warren for regular expression for url query params that differ in size, order and topic<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[4],"tags":[991],"keyring_services":[],"class_list":["post-52880","post","type-post","status-publish","format-standard","hentry","category-blih","tag-stackexchange"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/posts\/52880","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=52880"}],"version-history":[{"count":1,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/posts\/52880\/revisions"}],"predecessor-version":[{"id":52881,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/posts\/52880\/revisions\/52881"}],"wp:attachment":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=52880"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=52880"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=52880"},{"taxonomy":"keyring_services","embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fkeyring_services&post=52880"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}