replace_regex()
Applies to: ✅ Azure Data Explorer ✅ Azure Monitor ✅ Microsoft Sentinel
Replaces all regular expression matches with a specified pattern.
Deprecated aliases: replace()
Syntax
replace_regex(source,lookup_regex, rewrite_pattern)
Learn more about syntax conventions.
Parameters
| Name | Type | Required | Description |
|---|---|---|---|
| source | string |
✔️ | The text to search and replace. |
| lookup_regex | string |
✔️ | The regular expression to search for in text. The expression can contain capture groups in parentheses. To match over multiple lines, use the m or s flags. For more information on flags, see Grouping and flags. |
| rewrite_pattern | string |
✔️ | The replacement regex for any match made by matchingRegex. Use \0 to refer to the whole match, \1 for the first capture group, \2 and so on for subsequent capture groups. |
Returns
Returns the source after replacing all matches of lookup_regex with evaluations of rewrite_pattern. Matches do not overlap.
Example
range x from 1 to 5 step 1
| extend str=strcat('Number is ', tostring(x))
| extend replaced=replace_regex(str, @'is (\d+)', @'was: \1')
Output
| x | str | replaced |
|---|---|---|
| 1 | Number is 1.000000 | Number was: 1.000000 |
| 2 | Number is 2.000000 | Number was: 2.000000 |
| 3 | Number is 3.000000 | Number was: 3.000000 |
| 4 | Number is 4.000000 | Number was: 4.000000 |
| 5 | Number is 5.000000 | Number was: 5.000000 |
Related content
- To replace a single string, see replace_string().
- To replace multiple strings, see replace_strings().
- To replace a set of characters, see translate().