I'm using regex to search Google Cloud Logs for requests that are longer than 1000ms

Here are some example requests:

{
    ...
    textPayload: "GET /getUser 200 - - 5380.879 ms",
    ...
}
{
    ...
    textPayload: "GET /getUser 200 - - 34.879 ms",
    ...
}

Here is the search I'm using:

textPayload =~ "^(GET)|(POST).*[1-9][0-9][0-9][0-9]|\d{4,}(\sms)$"

I only want to return the one that ends with a value of over 1000.000 ms but my regex doesn't seem to work. What am I doing wrong?

CodePudding user response：

You need to use

textPayload =~ "^(?:GET|POST).* ([1-9]\d{3,}(?:\.\d )?)\sms$"

See the regex demo.

Details:

• ^ - start of string
• (?:GET|POST) - GET or POST
• .* - any zero or more chars other than line break chars as many as possible and then a space
• ([1-9]\d{3,}(?:\.\d )?) - Group 1: a non-zero digit, then three or more digits and then an optional sequence of a . and then one or more digits
• \s - a whitespace
• ms - ms string
• $ - end of string.