Who Me Too'd this topic

Who Me Too'd this topic

L0 Member

Minemeld Regex Syntax Issue

Hi Everyone,

 

I am having issues setting up a prototype within Minemeld to pull correctly pull values from an external XML URL feed. The issue is with the indicator regex

 

The data is provided in XML like this:

<uri>https://example.com</uri><type>combo</type><pubDate>Wed, Nov 14 2019 03:30:03 UTC</pubDate><guid>NA</guid></item><item><action>ADD</action>

<uri>https://example2.com</uri><type>combo</type><pubDate>Wed, Nov 13 2019 03:35:02 UTC</pubDate><guid>NA</guid></item><item><action>ADD</action>

 

The default indicator feed is:

indicator:
regex: <uri>(.*)</uri>
transform: \1

 

The aim is to read all the website values between the URI tags, however, this doesn't parse correctly and in the format above provides one result no matter how many entries are in the XML, returning all text between the first <uri> tag and the closing </uri> tag.

 

I was able to recreate this issue after testing this on an online regex website and it seems the solution is to add the ungreedy and global modifiers to the regex so it would like something like this:

regex: <uri>(.*?)</uri> /g

 

However, when I put this format into the indicators config in the Minemeld prototype I get 0 entries returned in the output. I think I am just formatting the regex wrong. Is anyone able to advise on the correct formatting to get Minemeld to accept these global modifiers?

 

Thanks

 

 

 

 

Tags (2)
Who Me Too'd this topic