Showing results for 
Show  only  | Search instead for 
Did you mean: 

Who Me Too'd this topic

Minemeld Regex Syntax Issue

L0 Member

Hi Everyone,


I am having issues setting up a prototype within Minemeld to pull correctly pull values from an external XML URL feed. The issue is with the indicator regex


The data is provided in XML like this:

<uri></uri><type>combo</type><pubDate>Wed, Nov 14 2019 03:30:03 UTC</pubDate><guid>NA</guid></item><item><action>ADD</action>

<uri></uri><type>combo</type><pubDate>Wed, Nov 13 2019 03:35:02 UTC</pubDate><guid>NA</guid></item><item><action>ADD</action>


The default indicator feed is:

regex: <uri>(.*)</uri>
transform: \1


The aim is to read all the website values between the URI tags, however, this doesn't parse correctly and in the format above provides one result no matter how many entries are in the XML, returning all text between the first <uri> tag and the closing </uri> tag.


I was able to recreate this issue after testing this on an online regex website and it seems the solution is to add the ungreedy and global modifiers to the regex so it would like something like this:

regex: <uri>(.*?)</uri> /g


However, when I put this format into the indicators config in the Minemeld prototype I get 0 entries returned in the output. I think I am just formatting the regex wrong. Is anyone able to advise on the correct formatting to get Minemeld to accept these global modifiers?







Who Me Too'd this topic