Ad Widget

Collapse

RegExp in preprocesing

Collapse
X
 
  • Time
  • Show
Clear All
new posts
  • knez
    Member
    • Dec 2019
    • 44

    #1

    RegExp in preprocesing

    Hello,

    I'm trying to do some RegExp in preprocessing:

    Trying this RegExp - \[?(({"{#SNMPINDEX}":"([0-9]){0,3}((\.0)|(\.[1-9][0-9]*)){2}","{#ZONA}":".{1,20}"}),)

    to apply on this string:

    [{"{#SNMPINDEX}":"1.1.0","{#ZONA}":"Cold A9A10"},{"{#SNMPINDEX}":"1.2.1.0","{#ZONA}":"280"} ,{"{#SNMPINDEX}":"1.2.2.0","{#ZONA}":"50"},{"{#S NM PINDEX}":"1.2.3.0","{#ZONA}":"0"},{"{#SNMPINDEX}": "1.3.1.0","{#ZONA}":"0"},{"{#SNMPINDEX}":"1.3. 2.0" ,"{#ZONA}":"0"},{"{#SNMPINDEX}":"1.3.3.0","{#ZO NA} ":"0"},{"{#SNMPINDEX}":"2.1.0","{#ZONA}":"Hot A7A8"},{"{#SNMPINDEX}":"2.2.1.0","{#ZONA}":"250"}, {"{#SNMPINDEX}":"2.2.2.0","{#ZONA}":"50"},{"{#S NMP INDEX}":"2.2.3.0","{#ZONA}":"0"},{"{#SNMPINDEX}":" 2.3.1.0","{#ZONA}":"0"},{"{#SNMPINDEX}":"2.3.2.0", "{#ZONA}":"0"},{"{#SNMPINDEX}":"2.3.3.0","{#ZO NA}" :"0"},{"{#SNMPINDEX}":"3.1.0","{#ZONA}":"Hot A4A5"},{"{#SNMPINDEX}":"3.2.1.0","{#ZONA}":"250"}, {"{#SNMPINDEX}":"3.2.2.0","{#ZONA}":"50"},{"{#S NMP INDEX}":"3.2.3.0","{#ZONA}":"0"},{"{#SNMPINDEX}":" 3.3.1.0","{#ZONA}":"0"},{"{#SNMPINDEX}":"3.3.2.0", "{#ZONA}":"0"},{"{#SNMPINDEX}":"3.3.3.0","{#ZO NA}" :"0"},{"{#SNMPINDEX}":"4.1.0","{#ZONA}":"Cold A6A7"},{"{#SNMPINDEX}":"4.2.1.0","{#ZONA}":"250"}, {"{#SNMPINDEX}":"4.2.2.0","{#ZONA}":"50"},{"{#S NMP INDEX}":"4.2.3.0","{#ZONA}":"0"},{"{#SNMPINDEX}":" 4.3.1.0","{#ZONA}":"0"},{"{#SNMPINDEX}":"4.3.2.0", "{#ZONA}":"0"},{"{#SNMPINDEX}":"4.3.3.0","{#ZO NA}" :"0"},{"{#SNMPINDEX}":"5.1.0","{#ZONA}":"Cold A1A2"},{"{#SNMPINDEX}":"5.2.1.0","{#ZONA}":"265"}, {"{#SNMPINDEX}":"5.2.2.0","{#ZONA}":"50"},{"{#S NMP INDEX}":"5.2.3.0","{#ZONA}":"0"},{"{#SNMPINDEX}":" 5.3.1.0","{#ZONA}":"0"},{"{#SNMPINDEX}":"5.3.2.0", "{#ZONA}":"0"},{"{#SNMPINDEX}":"5.3.3.0","{#ZO NA}" :"0"},{"{#SNMPINDEX}":"6.1.0","{#ZONA}":"Cold A4A5"},{"{#SNMPINDEX}":"6.2.1.0","{#ZONA}":"250"}, {"{#SNMPINDEX}":"6.2.2.0","{#ZONA}":"50"},{"{#S NMP INDEX}":"6.2.3.0","{#ZONA}":"0"},{"{#SNMPINDEX}":" 6.3.1.0","{#ZONA}":"0"},{"{#SNMPINDEX}":"6.3.2.0", "{#ZONA}":"0"},{"{#SNMPINDEX}":"6.3.3.0","{#ZO NA}" :"0"},{"{#SNMPINDEX}":"7.1.0","{#ZONA}":"Sensor 7"} ,{"{#SNMPINDEX}":"7.2.1.0","{#ZONA}":"250"},{"{# SN MPINDEX}":"7.2.2.0","{#ZONA}":"50"},{"{#SNMPINDEX} ":"7.2.3.0","{#ZONA}":"0"},{"{#SNMPINDEX}":"7. 3.1. 0","{#ZONA}":"0"},{"{#SNMPINDEX}":"7.3.2.0","{# ZON A}":"0"},{"{#SNMPINDEX}":"7.3.3.0","{#ZONA}":"0" }, {"{#SNMPINDEX}":"8.1.0","{#ZONA}":"Sensor8"},{" {#S NMPINDEX}":"8.2.1.0","{#ZONA}":"250"},{"{#SNMPINDE X}":"8.2.2.0","{#ZONA}":"50"},{"{#SNMPINDEX}":"8 .2 .3.0","{#ZONA}":"0"},{"{#SNMPINDEX}":"8.3.1.0","{# ZONA}":"0"},{"{#SNMPINDEX}":"8.3.2.0","{#ZONA}":"0 "},{"{#SNMPINDEX}":"8.3.3.0","{#ZONA}":"0"}]


    When I test it in regex101.com (https://regex101.com/r/90sfft/1) it works fine that is match only text that I need to match:

    [{"{#SNMPINDEX}":"1.1.0","{#ZONA}":"Cold A9A10"},
    {"{#SNMPINDEX}":"2.1.0","{#ZONA}":"Hot A7A8"},
    {"{#SNMPINDEX}":"3.1.0","{#ZONA}":"Hot A4A5"},
    {"{#SNMPINDEX}":"4.1.0","{#ZONA}":"Cold A6A7"},
    {"{#SNMPINDEX}":"5.1.0","{#ZONA}":"Cold A1A2"},
    {"{#SNMPINDEX}":"6.1.0","{#ZONA}":"Cold A4A5"},
    {"{#SNMPINDEX}":"7.1.0","{#ZONA}":"Sensor7"},
    {#SNMPINDEX}":"8.1.0","{#ZONA}":"Sensor8"},

    but, when I try to do that in preprocessing:
    Click image for larger version  Name:	img1.png Views:	0 Size:	7.9 KB ID:	430338
    with parameters:
    pattern=\[?(({"{#SNMPINDEX}":"([0-9]){0,3}((\.0)|(\.[1-9][0-9]*)){2}","{#ZONA}":".{1,20}"}),)
    output=\0

    I get only first match:
    "[{"{#SNMPINDEX}":"1.1.0","{#ZONA}":"Cold A9A10"},"

    i.e.:
    Click image for larger version  Name:	img2.png Views:	0 Size:	27.6 KB ID:	430339

    Can someone help me with this?
    Last edited by knez; 24-08-2021, 16:38.
  • knez
    Member
    • Dec 2019
    • 44

    #2
    anybody?

    Comment

    • johndoe2374
      Member
      • Aug 2021
      • 80

      #3
      It returns only the first matched result because you've put \0 in your output. As the documentation says (https://www.zabbix.com/documentation...reprocessing):
      output - output formatting template. An \N (where N=1…9) escape sequence is replaced with the Nth matched group.
      Also:
      Regular expression. Match the value to the <pattern> regular expression and replace value with <output>. The regular expression supports extraction of maximum 10 captured groups with the \N sequence.
      So I think it's useful if you need to get only one matched group and replace the whole result with it.

      Comment

      • knez
        Member
        • Dec 2019
        • 44

        #4
        Originally posted by cyber
        If you remove "global" flag in regex101 then you will also get only first match. I guess it is, how Zabbix treats the regexes.
        If your intent is to remove part of json and only keep those matching your regex, you should do it with JS preprocessing.
        Thank you, Cyber. I don't see how to put global flag in zabbix regex. When I try that (I wrote \g at the end of regex), I receive this error:
        • cannot perform regular expression "\[?(({"{#SNMPINDEX}":"([0-9]){0,3}((\.0)|(\.[1-9][0-9]*)){2}","{#ZONA}":".{1,20}"}),)\g" match for value of type "string": invalid regular expression: a numbered reference must not be zero

        Comment

        • knez
          Member
          • Dec 2019
          • 44

          #5
          I need to get all matches as output:
          [{"{#SNMPINDEX}":"1.1.0","{#ZONA}":"Cold A9A10"},
          {"{#SNMPINDEX}":"2.1.0","{#ZONA}":"Hot A7A8"},
          {"{#SNMPINDEX}":"3.1.0","{#ZONA}":"Hot A4A5"},
          {"{#SNMPINDEX}":"4.1.0","{#ZONA}":"Cold A6A7"},
          {"{#SNMPINDEX}":"5.1.0","{#ZONA}":"Cold A1A2"},
          {"{#SNMPINDEX}":"6.1.0","{#ZONA}":"Cold A4A5"},
          {"{#SNMPINDEX}":"7.1.0","{#ZONA}":"Sensor7"},
          {#SNMPINDEX}":"8.1.0","{#ZONA}":"Sensor8"},

          Comment

          • johndoe2374
            Member
            • Aug 2021
            • 80

            #6
            Still would be easier to use JavaScript preprocessing, I don't think you will be able to use default regexp preprocessing for that (search for "When the flag g is present, it returns every match as an array with groups."):

            Comment

            • knez
              Member
              • Dec 2019
              • 44

              #7
              Originally posted by johndoe2374
              Still would be easier to use JavaScript preprocessing, I don't think you will be able to use default regexp preprocessing for that (search for "When the flag g is present, it returns every match as an array with groups."):
              https://javascript.info/regexp-groups
              Thank You, johndoe2374!

              I tried that before, but I have some issues:

              I tried JS like this:
              Code:
              const regex = '\[?(({"{#SNMPINDEX}":"([0-9]){0,3}((\.0)|(\.[1-9][0-9]*)){2}","{#ZONA}":".{1,20}"}),)\g';
              result = value.match(regex);
              return result
              but that caused this errors in zabbix:
              • SyntaxError: unexpected closing parenthesis
              • at [anon] (duktape.c:87978) internal
              • at RegExp () native strict construct preventsyield
              • at match () native strict preventsyield
              • at [anon] (function:2) preventsyield
              It looks like duktape JS doesn't support formats like this.

              Can you help with this, please?
              Last edited by knez; 25-08-2021, 22:33.

              Comment


              • johndoe2374
                johndoe2374 commented
                Editing a comment
                Unfortunatelly I haven't used JavaScript myself for years, and most likely it's using other syntax, not PCRE. So you'll have to figure it out yourself.
            • knez
              Member
              • Dec 2019
              • 44

              #8
              Originally posted by cyber
              What is it that you want to achieve with this ? Remove unneeded things from result and feed it to discovery? Doing it with just reges ends with result not working as it is not a json any more.....
              Thanks again!

              I'm trying to set low-level discovery using SNMP to put item value (SNMP OID value) into another item name.

              Now I'm stuck with that "OID not changing." error.

              I created Template with discovery rule like this:

              Then I created Item Prototype, but my Discovery rule doesn't work with host I created with that Template.
              It says "OID not changing.".

              snmpwalk output is this:
              Code:
              iso.3.6.1.4.1.38783.1.2.2.1.[B]1[/B].1.0 = STRING: "Cold B5B6"
              iso.3.6.1.4.1.38783.1.2.2.1.[B]2[/B].1.0 = STRING: "Cold B3B4"
              iso.3.6.1.4.1.38783.1.2.2.1.[B]3[/B].1.0 = STRING: "Cold B7B8"
              iso.3.6.1.4.1.38783.1.2.2.1.[B]4[/B].1.0 = STRING: "Hot B6B7"
              iso.3.6.1.4.1.38783.1.2.2.1.[B]5[/B].1.0 = STRING: "Cold B9B10"
              iso.3.6.1.4.1.38783.1.2.2.1.[B]6[/B].1.0 = STRING: "Hot B4B5"
              iso.3.6.1.4.1.38783.1.2.2.1.[B]7[/B].1.0 = STRING: "Cold B2 TRh"
              (without unneeded OIDs and values for what I used JS and regex we talk about).

              OID part that is changing in OID is bolded, and that is in the middle of OID, so, I used that JavaScript to make SNMPINDEX walk from 1 to 8, but this looks completely wrong, because of that "OID not changing." error.

              When I test that discovery rule I get this:
              Click image for larger version

Name:	2.png
Views:	3525
Size:	1.37 MB
ID:	430549
              and this result looks good, but that discovery rule doesn't works with host.
              Attached Files

              Comment

              • knez
                Member
                • Dec 2019
                • 44

                #9
                anybody?

                Comment

                • cyber
                  Senior Member
                  Zabbix Certified SpecialistZabbix Certified Professional
                  • Dec 2006
                  • 4806

                  #10
                  If you remove "global" flag in regex101 then you will also get only first match. I guess it is, how Zabbix treats the regexes.
                  If your intent is to remove part of json and only keep those matching your regex, you should do it with JS preprocessing....

                  Comment

                  Working...