Regex - String within the first parenthesis of string

Question

I am trying to get an overview of the visitors of my website by using AWS Logs Insights.

My query looks like this:

fields @timestamp, @message
  | parse @message /(?<@ip>(?<=User-Agent)(.*)(?=X-Forwarded-Proto))/
  | stats count() as requestCount by @ip
  | filter ispresent(@ip)
  | sort requestCount desc

Some of the results are like this:

=Mozilla/5.0 (iPhone; CPU iPhone OS 15_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.1 Mobile/15E148 Safari/604.1,
=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1 Safari/605.1.15,

I am trying to get the string within the first parenthesis:

iPhone; CPU iPhone OS 15_1 like Mac OS X
Macintosh; Intel Mac OS X 10_15_7

I tried | parse @ip /(?<@device>(/\((.*?)\)/)/ from this answer but it doesn't work.

Any ideas how I could make it work?

Thank you!

The fourth bird · Accepted Answer · 2022-01-22 19:50:50Z

2

Looking at the result for the given pattern, you might use another named capture group (instead of a lookarounds, you might also match the text):

User-Agent=[^()]*\((?<@device>[^()]*)\).*X-Forwarded-Proto

See a regex demo.

With both capture groups:

User-Agent(?<@ip>[^()]*\((?<@device>[^()]*)\).*X-Forwarded-Proto)

See another regex demo.

answered Jan 22, 2022 at 19:50

The fourth bird

165k16 gold badges61 silver badges75 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Regex - String within the first parenthesis of string

1 Answer 1

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related