Gsub and reg expressions

sclarke · November 16, 2008, 8:03pm

I am having a few problems getting gsub to work with my regular
expressions.

I have a field full of data and therefore I am using a regular
expression to extract one part of it - #{event.description[/Logon
Type:\t2/]}

This works fine. I want to now add in gsub to replace ‘Logon Type: 2’
with the string ‘Local Logon’ - #{event.description.gsub([/Logon
Type:\t2/], ‘Local Logon’)}

However when i run this code i get the following error:

C:/Documents and Settings/sc/Desktop/test.rb:116:in `gsub’: wrong
argumen
t type Array (expected Regexp) (TypeError)

Does anyone have any ideas where I am going wrong?

Many thanks

sclarke · November 16, 2008, 8:09pm

Stuart C. wrote:

event.description.gsub([/Logon Type:\t2/], ‘Local Logon’)

However when i run this code i get the following error:

C:/Documents and Settings/sc/Desktop/test.rb:116:in `gsub’: wrong
argument type Array (expected Regexp) (TypeError)

Does anyone have any ideas where I am going wrong?

Ehrm, why did put the regex into an array? That’s what’s causing the
error.

HTH,
Sebastian

sclarke · November 16, 2008, 8:23pm

The regular expression needs to be in array otherwise I recover
everything from the event.description field and i only want that specfic
text.

Sebastian H. wrote:

Stuart C. wrote:

event.description.gsub([/Logon Type:\t2/], ‘Local Logon’)

However when i run this code i get the following error:

C:/Documents and Settings/sc/Desktop/test.rb:116:in `gsub’: wrong
argument type Array (expected Regexp) (TypeError)

Does anyone have any ideas where I am going wrong?

Ehrm, why did put the regex into an array? That’s what’s causing the
error.

HTH,
Sebastian

sclarke · November 16, 2008, 8:45pm

Stuart C. wrote:

The regular expression needs to be in array

It only needs to be in an array if you want to get an error. If you want
the
call to gsub to work the regex needs to NOT be in an array.
The first argument to gsub needs to be a regex (or a string). gsub
simply does
not accept an array as an argument.

otherwise I recover
everything from the event.description field and i only want that specfic
text.

I don’t follow you at all. What specific text? “Local Logon”? If you
just
want “Local Logon”, you can simply write “Local Logon” and not use gsub
at
all.

HTH,
Sebastian

sclarke · November 16, 2008, 8:40pm

On Sun, 16 Nov 2008 14:00:26 -0500, Stuart C. wrote:

However when i run this code i get the following error:

C:/Documents and Settings/sc/Desktop/test.rb:116:in `gsub’: wrong
argumen
t type Array (expected Regexp) (TypeError)

Does anyone have any ideas where I am going wrong?

Many thanks

get rid of the [] around the regular expression.

event.description.gsub(/Logon Type:\t2/, ‘Local Logon’)

sclarke · November 16, 2008, 9:00pm

On 16.11.2008 20:00, Stuart C. wrote:

I have a field full of data and therefore I am using a regular
expression to extract one part of it - #{event.description[/Logon
Type:\t2/]}

This works fine. I want to now add in gsub to replace ‘Logon Type: 2’
with the string ‘Local Logon’ - #{event.description.gsub([/Logon
Type:\t2/], ‘Local Logon’)}

As others have pointed out you are mixing up String#[] with String#gsub.

Note, that you can do replacements with String#[]= like this:

irb(main):001:0> s = “foo bar Logon Type:\t2 baz”
=> “foo bar Logon Type:\t2 baz”
irb(main):002:0> puts s
foo bar Logon Type: 2 baz
=> nil
irb(main):003:0> s[/Logon Type:\t2/] = ‘Local Logon’
=> “Local Logon”
irb(main):004:0> s
=> “foo bar Local Logon baz”
irb(main):005:0> puts s
foo bar Local Logon baz
=> nil

The “classic” version of course would be

irb(main):006:0> s = “foo bar Logon Type:\t2 baz”
=> “foo bar Logon Type:\t2 baz”
irb(main):007:0> s.gsub /Logon Type:\t2/, ‘Local Logon’
=> “foo bar Local Logon baz”

Note that in your case String#sub might be sufficient. Alternatives are
String#sub! and String#gsub! which you can use if you do not want to
retain the original string.

Cheers

robert

sclarke · November 16, 2008, 9:18pm

Stuart C. wrote:

I can assure you the only way I have been able to get this is by
#{event.description[/Logon Type:\t2/]}

Yes, but that’s not an array. That’s a method call to String#[]. This
has
nothing to do with what you’re trying to do with gsub.

If I change the expression to #{event.description(/Logon Type:\t2/)}.
It doesn’t work (I dont no why, guess its something to do with library).

That doesn’t work because you’re trying to pass the regexp as an
argument to
description and I assume that description wasn’t defined to take any
arguments.

To clarify I want to find Logon Type: 2 in the data set and change it to
Local logon.

string.gsub(/regex/, “replacement”) will find each part of string that
matches /regex/ and then replace those parts (and only those) with
“replacement”. The rest of the string will not be affected.
That’s exactly what you want, as far as I can tell, so just remove those
brackets.

Hope this helps, I do understand what you are saying with the reg
expressions but, all i can tell you is it works.

Well, obviously it doesn’t or you wouldn’t be here.
String#[] let’s you get a substring. gsub allows you to replace
substrings.
[]s don’t appear anywhere in the call to gsub except as part of the
regex.

HTH,
Sebastian

sclarke · November 16, 2008, 9:06pm

I see exactly what you are saying…below is my data set.

User Name: vmware_user
Domain: D79GVB3J
Logon ID: (0x0,0x2162E)
Logon Type: 2
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: D79GVB3J
Logon GUID: {00000000-0000-0000-0000-000000000000}

All this data is within event.description. My regular expression goes in
and grabs only Logon Type: 2.

I can assure you the only way I have been able to get this is by
#{event.description[/Logon Type:\t2/]}

If I change the expression to #{event.description(/Logon Type:\t2/)}.
It doesn’t work (I dont no why, guess its something to do with library).

To clarify I want to find Logon Type: 2 in the data set and change it to
Local logon.

Hope this helps, I do understand what you are saying with the reg
expressions but, all i can tell you is it works.

Sebastian H. wrote:

Stuart C. wrote:

The regular expression needs to be in array

It only needs to be in an array if you want to get an error. If you want
the
call to gsub to work the regex needs to NOT be in an array.
The first argument to gsub needs to be a regex (or a string). gsub
simply does
not accept an array as an argument.

otherwise I recover
everything from the event.description field and i only want that specfic
text.

I don’t follow you at all. What specific text? “Local Logon”? If you
just
want “Local Logon”, you can simply write “Local Logon” and not use gsub
at
all.

HTH,
Sebastian

sclarke · November 16, 2008, 9:29pm

Stuart C. wrote:

All this data is within event.description. My regular expression goes in
and grabs only Logon Type: 2.

I can assure you the only way I have been able to get this is by
#{event.description[/Logon Type:\t2/]}

event is some object

event.description is a string

So event.description[…] is calling the [] method on this string. This
is often referred to as the String#[] method (i.e. the instance method
‘[]’ on class String)

[] is one of those methods which can be called in a syntactic-sugary
way.

“abcdef”. # => “cd” - # direct call of [] method

“abcdef”[2,2] # => “cd” # same using [] method sugar

In any case, you’re not creating an array here. Rather you’re passing a
Regexp to the String#[] method.

If I change the expression to #{event.description(/Logon Type:\t2/)}.
It doesn’t work (I dont no why, guess its something to do with library).

It’s because you’re then trying to pass an argument to the
event.description() method. Note that

event.description

is the same as

event.description() # method call with zero arguments

but is not the same as

event.description(/foo/) # method call with one argument

You should have gotten an error message (“ArgumentError: wrong number of
arguments (1 for 0)” or something like that)

To clarify I want to find Logon Type: 2 in the data set and change it to
Local logon.

As others have said, the methods to look at are:

String#[]=        # modifies the string in-place
String.gsub!      # modifies the string in-place
String.gsub       # returns a new string

All these can take a simple string or a Regexp as the expression to
search for.

Hope this helps, I do understand what you are saying with the reg
expressions but, all i can tell you is it works.

You need to beware of things which look similar, but which are not.

foo[bar]                    # call of method '[]' on foo, 1 argument

[bar]                       # an array literal - 1-element array
                            # containing bar

foo.baz(bar)                # call of method 'baz' on foo, 1 arg
                            # which is bar

foo.baz([bar])              # call of method 'baz' on foo, 1 arg
                            # which is 1-element array containing

bar

In any case, ‘irb’ is the best place to try these things out.

irb(main):001:0> a = “hello”
=> “hello”
irb(main):002:0> a[“el”] = “EL”
=> “EL”
irb(main):003:0> a
=> “hELlo”
irb(main):004:0> a.gsub(/EL/,‘el’)
=> “hello”
irb(main):005:0> a # Note: a is unchanged
=> “hELlo”
irb(main):006:0> a.gsub!(/EL/,‘el’)
=> “hello”
irb(main):007:0> a
=> “hello”