Log Service supports regular expression functions. You can use these functions to query and analyze data.

You can use a regular expression function to parse a string and return required substrings.

The following table describes common regular expression functions.

Function Description Example
regexp_extract_all(string, pattern) Returns all the substrings that match the regular expression within the specified string as a string array. The returned result of *| SELECT regexp_extract_all('5a 67b 890m', '\d+') is ['5','67','890']. The returned result of *|SELECT regexp_extract_all('5a 67a 890m', '(\d+)a') is ['5a','67a'].
regexp_extract_all(string, pattern, group) Returns the part of the capturing group number that matches the regular expression in the specified string as a string array. The returned result of *| SELECT regexp_extract_all('5a 67a 890m', '(\d+)a',1) is ['5','67'].
regexp_extract(string, pattern) Returns the first substring that matches the regular expression within the specified string. The returned result of *|SELECT regexp_extract('5a 67b 890m', '\d+') is '5'.
regexp_extract(string, pattern,group) Returns the first substring in the part of the capturing group number that matches the regular expression within the specified string. The returned result of *|SELECT regexp_extract('5a 67b 890m', '(\d+)([a-z]+)',2) is 'a'.
regexp_like(string, pattern) Determines whether the string matches the regular expression and returns a Boolean result. These regular expressions allow partial matches. The returned result of *|SELECT regexp_like('5a 67b 890m', '\d+m') is true.
regexp_replace(string, pattern, replacement) Replaces the part of the specified string that matches the regular expression with the replacement part. The returned result of *|SELECT regexp_replace('5a 67b 890m', '\d+','a') is 'aa ab am'.
regexp_replace(string, pattern) Removes the parts that match the regular expression in the specified string. This function is equivalent to regexp_replace(string,patterm,'') The returned result of *|SELECT regexp_replace('5a 67b 890m', '\d+') is 'a b m'.
regexp_split(string, pattern) Splits the specified string into arrays. The returned result of *|SELECT regexp_split('5a 67b 890m', '\d+') is ['a','b','m'].