SOLVED

regex matching for multi-line strings

Copper Contributor

According to the documentation (https://docs.loganalytics.io/docs/Language-Reference/References/Regular-Expressions-syntax:(

"Flag syntax is xyz (set) or -xyz (clear) or xy-z (set xy, clear z)."

 

Unfortunately I did not find an example in the documentation on how to set the flags.

Example:

 

datatable(Message:string)
[
"Hello world",
"Hello
multi-line
world",
"foo bar"
]
| where Message matches regex "^Hello.*line.*$" 
 
returns no result because the m and s flags are not set.
 
The question is: how to set the "multi-line" (m) and the "dot matches newline" (s) flags in the query ?
 
Thank you in advance,
 
bye //emil.
1 Reply
best response confirmed by Emilian Ertel (Copper Contributor)
Solution

The solution is:

| where Message matches regex "(?ms)^Hello.*\\s*.*line.*$"

Thanks Yoni !

1 best response

Accepted Solutions
best response confirmed by Emilian Ertel (Copper Contributor)
Solution

The solution is:

| where Message matches regex "(?ms)^Hello.*\\s*.*line.*$"

Thanks Yoni !

View solution in original post