RegexExtractAll

Extraction of all matches from a specified regular expression pattern from a provided string. Returns an array of results. This differs from RegexGroups in several ways: * It returns all matches of the specified pattern, not just specific groups. This is useful for extracting things using a pattern where the content of the source string is indeterminate, such as extracting all email addresses. * Some "convenience" arguments have been added to enhance usability: multi-line, ignore_case, period_matches_newline * Added a new argument, "error_if_no_match". The script will not ordinarily throw an error if a match is not found but if not using as a transformer within a playbook, it may, in certain limited circumstances, be desirable to throw an error if the expression doesn't match. * It uses the 'regex' library, which supports more some more advanced regex functionality than the standard 're' library. For more info, see https://pypi.org/project/regex/.

Type

python

Pack

FiltersAndTransformers

Source

import demistomock as demisto  # noqa: F401
import regex
from CommonServerPython import *  # noqa: F401

# pylint: disable=no-member


def main():
    match_target = demisto.args()["value"]

    re_flags = regex.V1
    error_if_no_match = False
    unpack_matches = False

    try:
        if demisto.args()["multi_line"].lower() == "true":
            re_flags |= regex.MULTILINE

        if demisto.args()["ignore_case"].lower() == "true":
            re_flags |= regex.IGNORECASE

        if demisto.args()["period_matches_newline"].lower() == "true":
            re_flags |= regex.DOTALL

        if demisto.args()["error_if_no_match"].lower() == "true":
            error_if_no_match = True

        if demisto.args()["unpack_matches"].lower() == "true":
            unpack_matches = True

    except KeyError:
        pass

    regex_pattern = regex.compile(r"{}".format(demisto.args()["regex"]), flags=re_flags)

    try:
        matches = regex.findall(regex_pattern, match_target)

        if error_if_no_match is False or len(matches) != 0:
            if unpack_matches and matches:
                results = []
                for m in matches:
                    results.extend([v for v in (m if isinstance(m, tuple) else [m]) if v])
            else:
                results = matches

            demisto.results(results)
        else:
            return_error("No results found")

    except Exception:
        raise


if __name__ == "__builtin__" or __name__ == "builtins":
    main()

README