I'm having trouble matching a single quote, ' , or putting it in a character group in a Sumologic query.
For example, my query might look like
_sourceCategory="some_category" | where url matches /^\/stuff\/[\w']+\/.*/ and other_field="some_value"
The problem with this is that Sumologic will turn the characters after the single quote all red, as if it is the start of a string.
I've tried to escape it like [\w\']+
in my character group, and it doesn't work.
I couldn't find any resources online about this. The closest thing I found is
But I'm not sure how to correspond this to my type of query.
It appears that Sumologic uses RE2 in the where
clause, and in RE2, you can match any chars using hex character codes. So, you can use \x27
to match a '
char:
| where url matches /^\/stuff\/[\w\x27]+\/.*/
See the Go lang (that uses RE2 regex library) online regex demo.