| 1 | # Test PCRE2 named and numbered group logic |
| 2 | pattern: "(?P<timestamp>\\d{4}-\\d{2}-\\d{2})\\s+(?P<time>\\d{2}:\\d{2}:\\d{2})\\s+(?P<level>\\w+)\\s+(?P<component>\\w+):\\s+(?P<message>.*)" |
| 3 | |
| 4 | rewrite: |
| 5 | # Test named group reference |
| 6 | - key: FORMATTED_TIME |
| 7 | value: "${TIMESTAMP} ${TIME}" # Use named groups (keys are uppercased) |
| 8 | inject: yes |
| 9 | |
| 10 | # Test component extraction |
| 11 | - key: COMPONENT_NAME |
| 12 | value: "${COMPONENT}" |
| 13 | inject: yes |
| 14 | |
| 15 | # Test group in match pattern |
| 16 | - key: MESSAGE |
| 17 | match: "error\\s+(\\d+)" |
| 18 | value: "Error code: ${1}" |
| 19 | |
| 20 | # Test invalid group reference |
| 21 | - key: INVALID_GROUP |
| 22 | value: "${99} ${nonexistent}" |
| 23 | inject: yes |
| 24 | |
| 25 | # Test group with complex replacement |
| 26 | - key: MESSAGE |
| 27 | match: "user\\s+(?P<username>\\w+)\\s+failed\\s+(?P<attempts>\\d+)\\s+times" |
| 28 | value: "User ${username} had ${attempts} failed attempts" |