Kusto Regex Matches

Question

I'm trying write a query that will match logs where a field contains any domain other than our own. This is what I have tried:

| where Recipient matches regex @"(@(?!ourdomain)[A-Za-z0-9]+(.))"

But Kusto uses the re2 library which does not support lookarounds, as noted here: https://github.com/google/re2/wiki/Syntax

Is there a workaround in Kusto to exclude strings from regex matches?

clivewatson · Answer

Col_Sanders&nbsp;andrew_bryant&nbsp;
&nbsp;
This would ignore your domain&nbsp;
let Recepient = "This fake fakeperson@fake.com"; 
print Recepient
| extend ourDom = iif(not(Recepient matches regex @"([A-Za-z0-9]*ourdomain.com)"), 
                    extract (@"([A-Za-z0-9]*.com)",0,Recepient),
                    "Matched to ourdomain.com") 
| project ourDom
&nbsp;
&nbsp;

mperrotta · Answer

andrew_bryant&nbsp;I ran into the same issue. I wasn't able to find an answer to do this regex. What I ended up doing was using something like 'where&nbsp;Data.ObjectName&nbsp;!contains&nbsp;("System&nbsp;Volume&nbsp;Information")' to filter out strings I didn't to be included.&nbsp;Not sure if this will work in your scenario but this was the only solution I was able to come up with to address this.

andrew_bryant · Answer

mperrotta&nbsp;Thanks.&nbsp; I had thought of that.&nbsp; But this field could contain multiple domains in it.&nbsp; I want to match on any record where the field contains a domain other than ours, even if it also contains ours.

col_sanders · Answer

andrew_bryant&nbsp;do you have any updates on this matches regex issue?I seem to have run into it trying to implement two Sentinel query templates which use this function,&nbsp;e.g. this oneI also note an overnight post by another contributor which looks like a similar issue to me ...&nbsp;&nbsp;&nbsp;&nbsp;

col_sanders · Answer

Col_Sanders&nbsp;In&nbsp;case anyone else stumbles on this I'll just post my own fix/discovery for this.Turned out that whenever I used Intelli-sense to insert matches I would get the syntax error.By manually typing the word matches&nbsp;, no syntax error would occur!

Forum Discussion

Kusto Regex Matches

5 Replies

Resources