Trying to get the condition regex to work to capture domain and user-agent values with the 2 events in https://regex101.com/r/51mp2i/1 but only getting 1 match. How to update the regex to get 2 matches using condition regex? Thanks.
Match 1:
domain: example.org
useragent: "" or not capture
Match 2:
domain: example.org
useragent: Mozilla/5.0 (compatible;example-checks/1.0;+https://www.example.com/; check-id: 9EXc112795a4766a)
Use
"headers":\s+\[{"name":\s+"Host",\s+"value":\s+"(?<domain>[^"]+)(?:.*?"(?i)User-?(?i)Agent",\s+"value":\s+"(?<useragent>[^"]*))?
See proof.
EXPLANATION
--------------------------------------------------------------------------------
"headers": '"headers":'
--------------------------------------------------------------------------------
\s+ whitespace (\n, \r, \t, \f, and " ") (1 or
more times (matching the most amount
possible))
--------------------------------------------------------------------------------
\[ '['
--------------------------------------------------------------------------------
{"name": '{"name":'
--------------------------------------------------------------------------------
\s+ whitespace (\n, \r, \t, \f, and " ") (1 or
more times (matching the most amount
possible))
--------------------------------------------------------------------------------
"Host", '"Host",'
--------------------------------------------------------------------------------
\s+ whitespace (\n, \r, \t, \f, and " ") (1 or
more times (matching the most amount
possible))
--------------------------------------------------------------------------------
"value": '"value":'
--------------------------------------------------------------------------------
\s+ whitespace (\n, \r, \t, \f, and " ") (1 or
more times (matching the most amount
possible))
--------------------------------------------------------------------------------
" '"'
--------------------------------------------------------------------------------
( group and capture to \1:
--------------------------------------------------------------------------------
[^"]+ any character except: '"' (1 or more
times (matching the most amount
possible))
--------------------------------------------------------------------------------
) end of \1
--------------------------------------------------------------------------------
(?: group, but do not capture (optional
(matching the most amount possible)):
--------------------------------------------------------------------------------
.*? any character except \n (0 or more times
(matching the least amount possible))
--------------------------------------------------------------------------------
"User '"User'
--------------------------------------------------------------------------------
-? '-' (optional (matching the most amount
possible))
--------------------------------------------------------------------------------
Agent", 'Agent",'
--------------------------------------------------------------------------------
\s+ whitespace (\n, \r, \t, \f, and " ") (1
or more times (matching the most amount
possible))
--------------------------------------------------------------------------------
"value": '"value":'
--------------------------------------------------------------------------------
\s+ whitespace (\n, \r, \t, \f, and " ") (1
or more times (matching the most amount
possible))
--------------------------------------------------------------------------------
" '"'
--------------------------------------------------------------------------------
( group and capture to \2:
--------------------------------------------------------------------------------
[^"]* any character except: '"' (0 or more
times (matching the most amount
possible))
--------------------------------------------------------------------------------
) end of \2
--------------------------------------------------------------------------------
)? end of grouping