SNC Cribl MCP

{ "id": "regex_extract", "schema": { "type": "object", "title": "", "required": ["regex"], "properties": { "regex": { "type": "string", "title": "Regex", "description": "Regex literal with named capturing groups, such as (?<foo>bar), or _NAME_ and _VALUE_ capturing groups, such as (?<_NAME_0>[^ =]+)=(?<_VALUE_0>[^,]+)", "regexp": true }, "regexList": { "type": "array", "title": "Additional regex", "items": { "type": "object", "required": ["regex"], "properties": { "regex": { "type": "string", "title": "Regex", "description": "Regex literal with named capturing groups, such as (?<foo>bar), or _NAME_ and _VALUE_ capturing groups, such as (?<_NAME_0>[^ =]+)=(?<_VALUE_0>[^,]+)", "minLength": 1, "regexp": true } } } }, "source": { "type": "string", "title": "Source field", "description": "Field on which to perform regex field extraction", "default": "_raw" }, "iterations": { "type": "number", "title": "Max exec", "description": "The maximum number of times to apply regex to source field when the global flag is set, or when using _NAME_ and _VALUE_ capturing groups", "default": 100, "minimum": 1 }, "fieldNameExpression": { "title": "Field name format expression", "description": "JavaScript expression to format field names when _NAME_n and _VALUE_n capturing groups are used. Original field name is in global variable 'name'. Example: To append XX to all field names, use `${name}_XX` (backticks are literal). If empty, names will be sanitized using this regex: /^[_0-9]+|[^a-zA-Z0-9_]+/g. You can access other fields values via __e.<fieldName>.", "type": "string", "jsExpression": true }, "overwrite": { "type": "boolean", "title": "Overwrite existing fields", "description": "Overwrite existing event fields with extracted values. If disabled, existing fields will be converted to an array.", "default": false } } } }