Elastic search regex to get last 7 digits from right

Question

I have data indexed in this format 676767 2343423 2344444 32494444. I need a regular expression to pattern anlayser last 7 digits from right. Ex output: 2494444. Pattern which we have tried [0-9]{7} which is not working.

Answer 1

In ElasticSearch, the pattern is anchored by default. That means, you cannot rely on partial matches, you need to match the entire string and capture the last consecutive 7 digits.

Use

.*([0-9]{7})

where

• .* - will match any 0+ chars other than newline (as many as possible) and then will backtrack to match...
• ([0-9]{7}) - 7 digits placed into Capture group 1.

The Sense plug-in returns the captured value if a capturing group is defined in the regular expression pattern, so, no additional extraction work (or group accessing work) needs to be done.