使用集合让一切井井有条
根据您的偏好保存内容并对其进行分类。
re.capture
re.capture(stringText, regex)
说明
使用参数中提供的正则表达式模式从字符串捕获（提取）数据。
此函数接受两个参数：
stringText：要搜索的原始字符串。regex：指示要搜索的模式的正则表达式。
正则表达式可以在括号中包含 0 或 1 个捕获组。如果正则表达式包含 0 个捕获组，则该函数返回第一个整个匹配的子字符串。如果正则表达式包含 1 个捕获组，则它将返回捕获组的第一个匹配的子字符串。定义两个或多个捕获组会返回编译器错误。
形参数据类型
STRING，STRING
返回类型
STRING
代码示例
示例 1
在此示例中，如果 $e.principal.hostname 包含“aaa1bbaa2”，则该示例为 true，因为此函数会返回第一个实例。此示例不包含捕获组。
"aaa1" = re.capture($e.principal.hostname, "a+[1-9]")
示例 2
以下示例会捕获电子邮件地址中 @ 符号后面的所有内容。如果 $e.network.email.from 字段为 test@google.com，则该示例返回 google.com。以下示例包含一个捕获组。
"google.com" = re.capture($e.network.email.from , "@(.*)")
示例 3
如果正则表达式与文本中的任何子字符串都不匹配，则该函数会返回空字符串。排除空字符串使您可以省略没有发生匹配的事件，这在使用 re.capture() 和“不等于”运算时尤其重要：
// Exclude the empty string to omit events where no match occurs.
"" != re.capture($e.network.email.from , "@(.*)")
// Exclude a specific string with an inequality.
"google.com" != re.capture($e.network.email.from , "@(.*)")
如未另行说明，那么本页面中的内容已根据知识共享署名 4.0 许可获得了许可，并且代码示例已根据 Apache 2.0 许可获得了许可。有关详情，请参阅 Google 开发者网站政策。Java 是 Oracle 和/或其关联公司的注册商标。
最后更新时间 (UTC)：2025-07-29。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-07-29。"],[[["\u003cp\u003e\u003ccode\u003ere.capture\u003c/code\u003e extracts data from a string based on a provided regular expression pattern, supporting up to one capture group.\u003c/p\u003e\n"],["\u003cp\u003eThe function returns the entire matching substring if no capture groups are defined in the regular expression or the substring within the capture group if one is defined.\u003c/p\u003e\n"],["\u003cp\u003eIf the regular expression doesn't find a match, \u003ccode\u003ere.capture\u003c/code\u003e returns an empty string, allowing for the exclusion of non-matching events using inequality operators.\u003c/p\u003e\n"],["\u003cp\u003e\u003ccode\u003ere.capture\u003c/code\u003e takes two arguments, the \u003ccode\u003estringText\u003c/code\u003e, and the \u003ccode\u003eregex\u003c/code\u003e, and both of these arguments must be of the type \u003ccode\u003eSTRING\u003c/code\u003e.\u003c/p\u003e\n"],["\u003cp\u003e\u003ccode\u003ere.capture\u003c/code\u003e is supported in both \u003ccode\u003eRules\u003c/code\u003e and \u003ccode\u003eSearch\u003c/code\u003e environments, as specified in the supported in section.\u003c/p\u003e\n"]]],[],null,["### re.capture\n\nSupported in: \n[Rules](/chronicle/docs/detection/default-rules) [Search](/chronicle/docs/investigation/udm-search) \n\n re.capture(stringText, regex)\n\n#### Description\n\nCaptures (extracts) data from a string using the regular expression pattern\nprovided in the argument.\n\nThis function takes two arguments:\n\n- `stringText`: the original string to search.\n- `regex`: the regular expression indicating the pattern to search for.\n\nThe regular expression can contain 0 or 1 capture groups in parentheses. If the\nregular expression contains 0 capture groups, the function returns the first\nentire matching substring. If the regular expression contains 1 capture group,\nit returns the first matching substring for the capture group. Defining two or\nmore capture groups returns a compiler error.\n\n#### Param data types\n\n`STRING`, `STRING`\n\n#### Return type\n\n`STRING`\n\n#### Code samples\n\n##### Example 1\n\nIn this example, if `$e.principal.hostname` contains \"aaa1bbaa2\" the following would be true, because the function\nreturns the first instance. This example has no capture groups. \n\n \"aaa1\" = re.capture($e.principal.hostname, \"a+[1-9]\")\n\n##### Example 2\n\nThis example captures everything after the @ symbol in an email. If the\n`$e.network.email.from` field is `test@google.com`, the example returns\n`google.com`. The following example contains one capture group. \n\n \"google.com\" = re.capture($e.network.email.from , \"@(.*)\")\n\n##### Example 3\n\nIf the regular expression does not match any substring in the text, the\nfunction returns an empty string. You can omit events where no match occurs\nby excluding the empty string, which is especially important when you are\nusing `re.capture()` with an inequality: \n\n // Exclude the empty string to omit events where no match occurs.\n \"\" != re.capture($e.network.email.from , \"@(.*)\")\n\n // Exclude a specific string with an inequality.\n \"google.com\" != re.capture($e.network.email.from , \"@(.*)\")"]]
