I’ve found that my best friend in developing regex is https://regex101.com/. But, to use this tool with InsightConnect you need to know a few things:
- InsightConnect’s pattern match step is implemented in go, so on regex101 select Golang as the flavor on the left.
- InsightConnect implements a non-standard mechanism for capture groups so you can assign them a name - but they’re still just capture groups. Develop your regex with capture groups, then swap them out for ICON named capture groups.
Knowing these two things, we can develop exceedingly complex regex expressions with lots of debugging and reference support using regex101.com. Just paste your sample text you’re trying to extract data from, select Golang as the regex flavor, and start hacking away!
Once the regex is working, we need to translate it into InsightConnect. This isn’t as hard as it seems - it 's actually really straight forward.
Here’s a simple regex that extracts every word that ends in y (so it’ll match every day of the week!) but only after 'day: ':
day:\s+(\S+y)
Go ahead and put this into regex101 and it’ll give you a nice explanation of exactly how it works.
Regex101.com also nicely tells us that the string “today: monday” matches:
Full match 2-13 day: monday
Group 1. 7-23 monday
In InsightConnect, we want to capture “Group 1” into a variable named “day”. You should also note, that if regex101 reports a “Full Match” this is equivalent to the InsightConnect pattern match step’s $matched variable.
In InsightConnect, our capture groups look different - instead of using ‘(’ to mark the beginning of the group, we use ‘{{variable:/’ and instead of ‘)’ to close it, we use ‘/}}’. This is the only change needed to bring large and complex regex into the InsightConnect pattern match step. Just be careful, different flavors of regex support different features. A regex designed for python may not work in golang, and vice versa, so make sure you’ve tested it agains the right flavor! (again, regex101.com flavor on the left)
So, our fully vetted regex of
day:\s+(\S+y)
becomes
day:\s+{{day:/\S+y/}}
in InsightConnect and produces a nice “day” variable in our pattern match step output that we can use in later steps.
Finally, if we’re only expecting a single result, don’t forget to uncheck “Return Multiple Matches” to get a string output instead of an array of strings!