replace_regex()

Applies to: ✅ Azure Data ExplorerAzure MonitorMicrosoft Sentinel

Replaces all regular expression matches with a specified pattern.

Deprecated aliases: replace()

Syntax

replace_regex(source,lookup_regex, rewrite_pattern)

Learn more about syntax conventions.

Parameters

Name Type Required Description
source string ✔️ The text to search and replace.
lookup_regex string ✔️ The regular expression to search for in text. The expression can contain capture groups in parentheses.
rewrite_pattern string ✔️ The replacement regex for any match made by matchingRegex. Use \0 to refer to the whole match, \1 for the first capture group, \2 and so on for subsequent capture groups.

Returns

Returns the source after replacing all matches of lookup_regex with evaluations of rewrite_pattern. Matches do not overlap.

Example

range x from 1 to 5 step 1
| extend str=strcat('Number is ', tostring(x))
| extend replaced=replace_regex(str, @'is (\d+)', @'was: \1')

Output

x str replaced
1 Number is 1.000000 Number was: 1.000000
2 Number is 2.000000 Number was: 2.000000
3 Number is 3.000000 Number was: 3.000000
4 Number is 4.000000 Number was: 4.000000
5 Number is 5.000000 Number was: 5.000000