From: Stuart Clarke <stuart.clarke1986@...>
Date: 2008-11-17T05:03:26+09:00
Subject: Re: gsub and reg expressions

I see exactly what you are saying.....below is my data set.

User Name:  __vmware_user__
Domain:    D79GVB3J
Logon ID:    (0x0,0x2162E)
Logon Type:  2
Logon Process:  Advapi
Authentication Package:  Negotiate
Workstation Name:  D79GVB3J
Logon GUID:  {00000000-0000-0000-0000-000000000000}

All this data is within event.description. My regular expression goes in 
and grabs only Logon Type:  2.

I can assure you the only way I have been able to get this is by
#{event.description[/Logon Type\:\t2/]}

If I change the expression to #{event.description(/Logon Type\:\t2/)}. 
It doesn't work (I dont no why, guess its something to do with library).

To clarify I want to find Logon Type: 2 in the data set and change it to 
Local logon.

Hope this helps, I do understand what you are saying with the reg 
expressions but, all i can tell you is it works.

Sebastian Hungerecker wrote:
> Stuart Clarke wrote:
>> The regular expression needs to be in array
> 
> It only needs to be in an array if you want to get an error. If you want 
> the
> call to gsub to work the regex needs to NOT be in an array.
> The first argument to gsub needs to be a regex (or a string). gsub 
> simply does
> not accept an array as an argument.
> 
>> otherwise I recover 
>> everything from the event.description field and i only want that specfic
>> text.
> 
> I don't follow you at all. What specific text? "Local Logon"? If you 
> just
> want "Local Logon", you can simply write "Local Logon" and not use gsub 
> at
> all.
> 
> HTH,
> Sebastian

-- 
Posted via http://www.ruby-forum.com/.