LogoLogo
WebsiteBlogLogin
  • Onum Docs
  • Use Cases
  • Videos
  • Release Notes
  • Welcome
  • Getting Started
    • About Onum
    • Architecture
    • Deployment
    • Getting Started with Onum
    • Understanding The Essentials
      • Cards and Table Views
      • Data Types
      • Graph Calculations
      • The Time Range Selector
    • Key Terminology
  • THE WORKSPACE
    • Home
    • Listeners
      • Cloud Listeners
      • Listener Integrations
        • Amazon SQS
        • Amazon S3
        • Apache Kafka
        • Azure Event Hubs
        • Cisco NetFlow
        • Google Pub/Sub
        • HTTP
        • HTTP Pull
        • Microsoft 365
        • OpenTelemetry
        • Syslog
        • TCP
      • Labels
    • Pipelines
      • Building a Pipeline
        • AI Assistant
          • AI Pipeline Assistant
          • AI Action Assistant
      • Listeners
      • Actions
        • Advanced
          • Anonymizer
          • Bring Your Own Code
          • Field Generator
          • For Each
          • Google DLP
          • HTTP Request
          • Redis
        • Aggregation
          • Accumulator
          • Group By
        • AI
          • Amazon GenAI
          • BLIP-2
          • Cog
          • Google GenAI
          • Llama
          • Replicate
        • Detection
          • Sigma Rules
        • Enrichment
          • Lookup
        • Filtering
          • Conditional
          • Sampling
        • Formatting
          • Message Builder
        • Transformation
          • Field Transformation
            • Field Transformation Operations
              • Arithmetic / Logic
                • Divide Operation
                • Median
                • Multiply Operation
                • Subtract Operation
                • Sum Operation
              • Code tidy
                • JSON Minify
              • Control characters
                • Escape String
                • Unescape String
              • Conversion
                • Convert Area
                • Convert Data Units
                • Convert Distance
                • Convert Mass
                • Convert Speed
                • List to String
                • String to List
              • Data format
                • From Base
                • From Base64
                • From Hex
                • To Base
                • To Base64
                • To Hex
              • Date / Time
                • From Unix Timestamp
                • To Timestamp
                • To Unix Timestamp
                • Translate Datetime Format
              • Encoding / Decoding
                • From Binary
                • To Binary
                • To Decimal
              • Encryption / Encoding
                • JWT Decode
              • File system permissions
                • Parse Unix file permissions
              • Format conversion
                • CSV to JSON
                • JSON to CSV
              • Hashing
                • Keccak
                • MD2
                • MD4
                • MD5
                • SHA0
                • SHA1
                • SHA2
                • SHA3
                • Shake
                • SM3
              • Networking
                • Defang IP Address
                • Defang URL
                • Extract IP Address
                • Fang IP Address
                • Fang URLs
                • IP to Hexadecimal
                • Parse URI
                • URL Decode
                • URL Encode
              • Other
                • Parse Int
              • String
                • Length
              • Text sample adding
                • Pad Lines
              • Utils
                • Byte to Human Readable
                • Count Occurrences
                • CRC8 Checksum
                • CRC16 Checksum
                • CRC24 Checksum
                • CRC32 Checksum
                • Credit Card Obfuscator
                • Filter
                • Find and Replace
                • Regex
                • Remove Whitespace
                • Reverse String
                • Shuffle
                • Sort
                • Substring
                • Swap Case
                • To Lower Case
                • To Upper Case
          • Flat JSON
          • JSON Transformation
          • JSON Unroll
          • Math Expression
          • Parser
            • PCL (Parser Configuration Language)
        • Utils
          • Unique
      • Data sinks
      • Bulk Changes
      • Publishing & Versioning
      • Test your Pipeline
    • Data sinks
      • Data sink Integrations
        • Amazon S3
        • Amazon SQS
        • Azure Blob Storage
        • Azure Event Hubs
        • Devo
        • Google BigQuery
        • Google Cloud Storage
        • Google Pub/Sub
        • HTTP
        • Jira
        • Mail
        • Null
        • OpenTelemetry
        • PagerDuty
        • Pushover
        • Qradar
        • Relational Databases
        • ServiceNow
        • Slack
        • Splunk HEC
        • Syslog
        • TCP
        • Telegram
        • Twilio
    • Alerts
  • YOUR VAULT
    • Enrichment
    • Data History
    • Actions
  • ADMINISTRATION
    • Tenant Menu
    • Global Settings
      • Your Account
      • Organization Settings
        • Secrets Management
      • Tenant
        • Authentication
        • Users
        • Activity Log
  • MARKETPLACE
    • Onum Marketplace
      • Pulling Pipelines
        • Netskope Events Alert
        • OKTA System Log API
        • Sophos Connector SIEM
Powered by GitBook
On this page
  • Description
  • Data types
  • Input data
  • Output data
  • Parameters
  • Examples

Was this helpful?

Export as PDF
  1. THE WORKSPACE
  2. Pipelines
  3. Actions
  4. Transformation
  5. Field Transformation
  6. Field Transformation Operations
  7. Utils

Find and Replace

PreviousFilterNextRegex

Last updated 13 days ago

Was this helpful?

Description

This operation allows you to search for specific patterns within your input data and replace them with new text.


Data types

These are the input/output expected data types for this operation:

Input data

- Text or data where you want to perform find-and-replace operations.

Output data

- Output strings after the find-and-replace operations.


Parameters

These are the parameters you need to configure to use this operation (mandatory parameters are marked with a *):

Substring to find*

Enter the text or pattern you want to find in the input.

Replacement*

Enter the text with which you want to replace each match. You can use RegEx patterns here.

Global Match*

Set true if you want to replace all matches found. If this is set to false, only the first match will be replaced. The default value is true.

Case Insensitive*

Set true if you want to ignore case when matching. The default value is false.

Multiline*

Set true to enable multiline mode. This feature controls how to treat line breaks in the input. Specifically, it affects the behavior of the ^ and $ anchors in the RegEx patterns you use in the Substring to find parameter.

  • When Multiline is enabled:

    • ^ matches the start of a line, not just the start of the whole input.

    • $ matches the end of a line, not just the end of the whole input.

    • This means the regex treats the input as multiple lines, and you can match patterns at the beginning/end of each line.

  • When Multiline is disabled:

    • ^ and $ only match the start and end of the entire input, respectively.

    • This is useful for matching patterns that span across the whole input or aren't line-sensitive.

The default value is false.

Example

Example with Multidata activated:

Input data:

Info: All systems operational  
Error: Disk space low  
Warning: CPU usage high  
Error: Memory leak detected
  • Substring to find - ^Error:.*

  • Replacement - ALERT

  • Multiline - true

Output data:

Info: All systems operational  
ALERT  
Warning: CPU usage high  
ALERT

Example with Multidata deactivated:

Input data:

Info: All systems operational  
Error: Disk space low  
Warning: CPU usage high  
Error: Memory leak detected
  • Substring to find - ^Error:.*

  • Replacement - ALERT

  • Multiline - false

Output data:

Info: All systems operational  
Error: Disk space low  
Warning: CPU usage high  
Error: Memory leak detected

Because ^ only applies to the start of the whole input with multiline off, the pattern never matches.

Dot Matches All*

Set true to match new line characters. Specifically, this affects how the . (dot) behaves in the RegEx patterns you use in the Substring to find parameter.

When Dot Matches All is enabled, the dot (.) also matches newline characters, allowing patterns to match across multiple lines.

The default value is false.

Example

Example with Dot Matches All activated:

Input data:

<start>
line 1
line 2
<end>
  • Substring to find - <start>.*<end>

  • Replacement - [BLOCK]

  • Dot Matches All - true

Output data:

[BLOCK] 

.* includes newlines, so everything from <start> to <end> is matched and replaced.


Example with Dot Matches All deactivated:

Input data:

<start>
line 1
line 2
<end>
  • Substring to find - <start>.*<end>

  • Replacement - [BLOCK]

  • Dot Matches All - false

Output data:

<start>
line 1
line 2
<end>

.* does not match across newlines, so no match occurs.


Examples

Suppose you want to replace all the occurrences of the word "error" with "issue". To do it:

  1. In the Operation field, choose Find and replace.

  2. Set Substring to find to error.

  3. Set Replacement to issue.

  4. Set Global Match to true.

  5. Set Case Insensitive to true.

  6. Set Multiline to false.

  7. Set Dot Matches All to false.

  8. Give your Output field a name and click Save. The count will be displayed in the output field.

You can try out operations with specific values using the Input field above the operation. You can enter the value in the example above and check the result in the Output field.

In this example, given the following string:

The server encountered an error while processing your request.

you'll get this output:

The server encountered an issue while processing your request.

In your Pipeline, open the required configuration and select the input Field.

Action