Re: few words

[Marcio Humpris <ma...@gmail.com>]

Bowie Bailey <Bowie_Bailey <at> BUC.com> writes:

> > how can I adjust it?
> 
> First thought would be:
> 
> rawbody __RB_2_WDS /^(?:\s*\S+){0,2}\s*$/
> 
> Untested...  Should match empty message, message with only whitespace, 
> or message with one or two words.
> 

Thank you...

But how to make it catch just an email with ONLY 2 words in BODY? Not match
empty message?

Thanks

Re: few words

[Bowie Bailey <Bo...@BUC.com>]

On 12/6/2013 3:23 PM, Marcio Humpris wrote:
> Bowie Bailey <Bowie_Bailey <at> BUC.com> writes:
>
>>> how can I adjust it?
>> First thought would be:
>>
>> rawbody __RB_2_WDS /^(?:\s*\S+){0,2}\s*$/
>>
>> Untested...  Should match empty message, message with only whitespace,
>> or message with one or two words.
>>
> Thank you...
>
> But how to make it catch just an email with ONLY 2 words in BODY? Not match
> empty message?

If you don't want it to match an empty message, just change {0,2} to {1,2}.

Regexp translates to:

^      Beginning of string
(?:    Start group
\s*    Zero or more whitespace characters
\S+    One or more non-whitespace characters
)      End group
{1,2}  One to two matches of the preceding group
\s*    Zero more more whitespace characters
$      End of string

As Amir mentioned, you should read up on Perl regular expressions if you 
want to create SA rules.

-- 
Bowie

Re: few words

[Amir 'CG' Caspi <ce...@3phase.com>]

On Fri, December 6, 2013 1:23 pm, Marcio Humpris wrote:
> But how to make it catch just an email with ONLY 2 words in BODY? Not
> match empty message?

I strongly recommend http://www.regular-expressions.info to learn how
regexps work.  If you want to catch _exactly_ two words then you'd do
something like:

rawbody __RB_2_WDS /^(?:\s*\S+\s+\S+\s*$/

(In the original example, changing the {0,2} to {2} would match single
words too, since the whitespace is optional, but would not match an empty
message.)

Note that \S matches anything that isn't whitespace, which includes
punctuation.  If you only want alphabetic characters (no digits, no
punctuation, etc.) then replace \S with [A-Za-z-] or \w.

You'll learn a whole lot more if you follow the link in the first sentence.

						--- Amir