Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Table of Contents
maxLevel2
typeflat

...

How does it work in the search window?

Select Create column in the search window toolbar, then select the Peek operation. You need to specify at least two arguments:

Argument

Data type

String mandatory

string

Pattern mandatory

regexp

Capturing group

integer

The data type of the values in the new column is string.

Info

Take care when using strings containing the \ escape character. For every \ in the string you must add \\\\ (4), resulting in a total of \\\\\ (5). This is because the Java compiler needs \\ and the regex engine also needs \\.

Given messages like these already ingested in Devo:

{\"request\":{\"Id\":23456,\"Email\":\marketing@devo.com"\",\"Company\":\"Devo\",\"Team\":\"Marketing\"}}

{\"request\":{\"Id\":34567,\"Email\":\sales@devo.com\",\"Company\":\Devo\",\"Team\":\"Sales\"}}

{\"request\":´\"Id\":12345,\"Email\":\"support@devo.com\",\"Company\":\"Devo\",\"Team\":\"Customer Support\"}}

To retrieve the email address value, you can use this code:

select peek(message, re("\\\\\"Email\\\\\":\\\\\"(.*?)\\\\\""),1) as email

Example

In the demo.ecommerce.data table, we want to extract only the days of our timestamp column. To do it, we will create a new column using the Peek operation.

...

Note

When you use the Peek operation in a LINQ query, you must use the Regular expression, regexp operation to transform the string value entered to regexp format. To do it, add the re() syntax as in the above examples.

When you apply this operation in the search window interface, Devo automatically transforms your string value to regexp data type, so you don't need to do anything.

Example

You can copy the following LINQ script and try the above example on the demo.ecommerce.data table. 

Code Block
from demo.ecommerce.data
select peek(timestamp, re(".\\d"), 0) as timestamp_days