Skip navigation
All Places > Products > RSA NetWitness Platform > RSA NetWitness Platform Online Documentation > Documents
Log in to create and rate content, and to follow, bookmark, and share content with other members.

Decoder: Regex

Document created by RSA Information Design and Development Employee on Sep 13, 2017Last modified by RSA Information Design and Development Employee on Jan 6, 2021
Version 25Show Document
  • View in full screen mode

This topic defines language for the flex parser regex node.

Regex searches the stream payload starting at the read position for matches to a provided regular expression. If matches are found, the offset from the read position and, optionally the matched string, is returned. Any child elements execute. If no matches are found, child elements do not execute.

Language Definition

Attribute NameDescription
name number variable to receive the offset from the read position where the match begins.
value A regular expression to find.
length (optional)A limit to the length of the payload to be searched. If a limit is not provided, the remainder of the payload is searched. It is recommended to always use the smallest value possible here in order to reduce the effect on performance. 
found (optional)The name of a string variable to receive a matched string.

Previous Topic:Payload Functions
Next Topic:String Functions
You are here
Table of Contents > Configure Parsers and Feeds > Configure Parsers > Flex Parser > Regex