You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@metron.apache.org by "Otto Fowler (Jira)" <ji...@apache.org> on 2020/04/29 15:04:00 UTC
[jira] [Commented] (METRON-2339) Can not match backslash in
REGEXP_MATCH Stellar REPL
[ https://issues.apache.org/jira/browse/METRON-2339?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17095530#comment-17095530 ]
Otto Fowler commented on METRON-2339:
-------------------------------------
If you can confirm that '\\\' works for you then this is a dupe of METRON-2002, it looks like you did 1 and 3.
> Can not match backslash in REGEXP_MATCH Stellar REPL
> ----------------------------------------------------
>
> Key: METRON-2339
> URL: https://issues.apache.org/jira/browse/METRON-2339
> Project: Metron
> Issue Type: Bug
> Affects Versions: 0.7.1
> Environment: centos 7
> Reporter: Dima Kovalyov
> Priority: Major
> Labels: stellar
>
> If I have a message with a backslash like C:\Windows
> How can I use REGEXP_MATCH to Profile this message?
> Here is where it does not work for me. I have a message:
> {code:java}
> {
> "line": "test"
> } {code}
> To keep it simple this is just text with no special characters.
> Using Stellar REPL I create the following profile:
> {code:java}
> {
> "profiles": [{
> "profile": "match-backslash",
> "foreach": "line",
> "onlyif": "REGEXP_MATCH(line, '\\')",
> "init": { "count": "0" },
> "update": { "count": "count + 1" },
> "result": "total"
> }
> ]
> } {code}
> Here is what happens when I apply any message:
> {code:java}
> [Stellar]>>> PROFILER_APPLY(msg, profile)
> 2020-01-09 18:24:26 ERROR DefaultMessageRouter:123 - error while executing profile; profile='match-backslash', error='Unable to parse: REGEXP_MATCH(line, '\') due to: Syntax error @ 1:26 no viable alternative at input 'REGEXP_MATCH(line,'''
> org.apache.metron.stellar.dsl.ParseException: Unable to parse: REGEXP_MATCH(line, '\') due to: Syntax error @ 1:26 no viable alternative at input 'REGEXP_MATCH(line,'' {code}
> If I escape more:
> {code:java}
> {
> "profiles": [{
> "profile": "match-backslash",
> "foreach": "line",
> "onlyif": "REGEXP_MATCH(line, '\\\\')",
> "init": { "count": "0" },
> "update": { "count": "count + 1" },
> "result": "total"
> }
> ]
> } {code}
> I'll get this:
> {code:java}
> [Stellar]>>> PROFILER_APPLY(msg, profile)
> 2020-01-09 18:11:31 ERROR DefaultMessageRouter:123 - error while executing profile; profile='profiler_test', error='Unable to parse: REGEXP_MATCH(line, '\\') due to: Unexpected internal error near index 1
> \ with relevant variables line=test'
> org.apache.metron.stellar.dsl.ParseException: Unable to parse: REGEXP_MATCH(line, '\\') due to: Unexpected internal error near index 1
> \ with relevant variables line=test {code}
>
> METRON-1922 - this does not affect me
> METRON-2002 - this might be relevant
--
This message was sent by Atlassian Jira
(v8.3.4#803005)