Question:

Can you perform a cases insensitive parse regex in Sumo Logic? For instance, I have a specific string I want to parse, however the string is often mixed case.

Answer:

Yes, you can tell the parser to use case insensitivity by supplying the regex parameter of (?i). For example, let's say we have the following log messages:

Line1: The following exception was reported: error in log
Line2: The following exception was reported: Error in log
Line3: The following exception was reported: ERROR in log

 

Use the following parse regex expression to match the "error" in the logs. The (?i) tells the parser to ignore case for the trailing expression.

| parse regex "reported:\s(?<exception>(?i)error)\s"

 This would result in the following parsed fields

Exception Message
ERROR Line3: The following exception was reported: ERROR in log
Error Line2: The following exception was reported: Error in log
error Line1: The following exception was reported: error in log

 

You can also use the toLowerCase and to UpperCase operators.