Fix issue #173

[gianluca-valentini]

This is the fix for the above issue.
I did some unit test, please perform some end2end test before merging

[CLAassistant]

All committers have signed the CLA.

[joschi]

@gianluca-valentini Thanks for your contribution! We'll triage and take a look at it as soon as possible!

Please make sure that all existing unit tests pass your changes and that you keep using the code style of the existing code (indentation, order of imports etc.) to make reviewing this as swift as possible.

[joschi]

@andrea-tomassi Please don't commit IDE configuration files.

Additionally, if you intend to contribute to this PR, you also need to sign the CLA.

[andrea-tomassi]

@joschi sure, I already reverted this commit. It was just a mistake.

[gianluca-valentini]

Hi guys,
can you tell me when the issue will be fixed or my pull request could be merged?

[joschi]

@gianluca-valentini We will review this PR as soon as the tests run successfully (see https://travis-ci.org/Graylog2/graylog-plugin-pipeline-processor/builds/222069537) and unnecessary whitespace changes have been reverted.

[gianluca-valentini]

Hi,
I think that this issue is present on 2.2.3 too

[joschi]

@gianluca-valentini Any news on fixing the aforementioned issues with this pull request?

[gianluca-valentini]

Hi @joschi
I have no news about this issue. I thought the correction could be applied soon.
Currently, looking the master stream, org.graylog.plugins.pipelineprocessor.functions.strings.RegexMatch still contains the old (and with bug) code.

I just underlined, some days ago, that this problem is present as in the master as in the v2.2.3 too.

[joschi]

@gianluca-valentini The build for the master branch on Travis CI is green (https://travis-ci.org/Graylog2/graylog-plugin-pipeline-processor/branches), so it seems that the build fails/failed because of a change in this PR.

Additionally, please address the issue with the whitespace changes (tabs vs. spaces) in this PR.

[gianluca-valentini]

Hi @joschi, I changed the java using the online editor as I cannot find my local git project as I reset my pc some days ago.

[bernd]

@joschi @gianluca-valentini How do we continue with this?

[joschi]

@bernd I would close this PR without merging as it breaks the behavior of the regex() function and it doesn't seem to be possible to come up with a sensible solution given the harsh restrictions of the rule language.

See #197 for a cleaned up (and ultimately closed) version of this PR.

[bernd]

Okay, I am closing this. Thanks for the feedback!

[gianluca-valentini]

Hi @joschi ,please can you explain me what do you mean when you say about this fix that it

breaks the behavior of the regex() function

What is the expected behavior, in your opinion, if more then one match happens for a single group?
thanks
Gianluca

[joschi]

@gianluca-valentini Feel free to follow up on #197 and its discussion.