Update regex notebook 2

fkie-cad · Dec 18, 2024 · fe93b1a · fe93b1a
1 parent 3ebedc3
commit fe93b1a
Showing 1 changed file with 15 additions and 15 deletions.
diff --git a/doc/source/development/notebooks/processor_examples/regex.ipynb b/doc/source/development/notebooks/processor_examples/regex.ipynb
@@ -137,7 +137,7 @@
   },
   {
    "cell_type": "code",
-   "execution_count": 24,
+   "execution_count": 32,
    "metadata": {},
    "outputs": [
     {
@@ -152,14 +152,14 @@
      "output_type": "stream",
      "text": [
       "before: {'data_stream': {'dataset': 'windows', 'namespace': 'devopslab', 'type': '/logs/'}, '_op_type': 'create'}\n",
-      "after: {'data_stream': {'dataset': 'windows', 'namespace': 'devopslab', 'type': '/logs/'}, '_op_type': 'create'}\n",
+      "after: {'data_stream': {'dataset': 'windows', 'namespace': 'devopslab', 'type': '/logs/'}, '_op_type': 'create', '_index': '/logs/-windows-devopslab'}\n",
       "False\n"
      ]
     }
    ],
    "source": [
     "rule_yaml = \"\"\"---\n",
-    "filter: 'data_stream.type: \"/d.*lo.*/\"'     \n",
+    "filter: 'data_stream.type: \"/.*lo.*/\"'     \n",
     "regex_fields:\n",
     "  - \"data_stream.type\"\n",
     "concatenator:\n",
@@ -216,31 +216,32 @@
   },
   {
    "cell_type": "code",
-   "execution_count": 20,
+   "execution_count": 38,
    "metadata": {},
    "outputs": [
     {
-     "name": "stderr",
+     "name": "stdout",
      "output_type": "stream",
      "text": [
-      "[Deprecated]: regex_fields are no longer necessary. Use Lucene regex annotation.\n"
+      "before: {'data_stream': {'dataset': 'windows', 'namespace': 'devopslab', 'type': '/logs/'}, '_op_type': 'create'}\n",
+      "after: {'data_stream': {'dataset': 'windows', 'namespace': 'devopslab', 'type': '/logs/'}, '_op_type': 'create', '_index': '/logs/-windows-devopslab'}\n",
+      "False\n"
      ]
     },
     {
-     "name": "stdout",
+     "name": "stderr",
      "output_type": "stream",
      "text": [
-      "before: {'data_stream': {'dataset': 'windows', 'namespace': 'devopslab', 'type': '/logs/'}, '_op_type': 'create'}\n",
-      "after: {'data_stream': {'dataset': 'windows', 'namespace': 'devopslab', 'type': '/logs/'}, '_op_type': 'create'}\n",
-      "False\n"
+      "<>:1: SyntaxWarning: invalid escape sequence '\\/'\n",
+      "<>:1: SyntaxWarning: invalid escape sequence '\\/'\n",
+      "/tmp/ipykernel_3404/1194941343.py:1: SyntaxWarning: invalid escape sequence '\\/'\n",
+      "  rule_yaml = \"\"\"---\n"
      ]
     }
    ],
    "source": [
     "rule_yaml = \"\"\"---\n",
-    "filter: 'data_stream.type: \".*lo.*\"'     \n",
-    "regex_fields:\n",
-    "  - \"data_stream.type\"\n",
+    "filter: 'data_stream.type: /\\/.*lo.*/'    \n",
     "concatenator:\n",
     "  source_fields:\n",
     "    - data_stream.type\n",
@@ -251,8 +252,7 @@
     "  overwrite_target: false\n",
     "  delete_source_fields: false\n",
     "\"\"\"\n",
-    "\n",
-    "concat_with_rule(rule_yaml)\n"
+    "concat_with_rule(rule_yaml)"
    ]
   },
   {