I am using Kusto query language and my sample data is:

LoginGetWalletSuccess 
LoginGetWalletFailed 
FirstTimeLoginSuccess 
FirstTimeLoginFailed 
LoginBySalesforceSuccess 
LoginBySalesforceFailed

and the regex I came up is: (?:Login)(. )(?:Success|Failed)

I am having this result with the regex above:

GetWallet
FirstTimeLoginSuccess
FirstTimeLoginFailed
BySalesforce
BySalesforce

But I would like to have as a result the following:

GetWallet
FirstTime
FirstTime
BySalesforce
BySalesforce

CodePudding user response：

Add Login to the trailing match and make the match reluctant (by added a ?):

(?:Login)?(. ?)(?:Success|Failed|Login)

See live demo.

CodePudding user response：

Option 1.

replace_regex

That would be the most generic solution, agnostics to the number of words and their order.

datatable (txt:string)
[
     "LoginGetWalletSuccess" 
    ,"LoginGetWalletFailed" 
    ,"FirstTimeLoginSuccess" 
    ,"FirstTimeLoginFailed" 
    ,"LoginBySalesforceSuccess" 
    ,"LoginBySalesforceFailed"
]
|   extend  replace_regex(txt, "Login|Success|Failed", "")

Fiddle

Option 2.

trim

Assuming you are searching for a single, continues expression

datatable (txt:string)
[
     "LoginGetWalletSuccess" 
    ,"LoginGetWalletFailed" 
    ,"FirstTimeLoginSuccess" 
    ,"FirstTimeLoginFailed" 
    ,"LoginBySalesforceSuccess" 
    ,"LoginBySalesforceFailed"
]
|   extend  trim("Login|Success|Failed", txt)

Fiddle