Not able to get Regex to get just the filename from the full path working with Vector

[harikeshtripathi]

I'm trying to write a transform where I want to get just the filename from the full pathname. I have a got a Rust regular expression which is working on Rust's regular expression test site but when I put the same inside the "remap" transform it does not work.

My input is -

# cat input.json
{"file":"/opt/application/service-manager-2/logs/service-manager.log","hostname":"ab126310fc26","message":"{\"level\":\"info\",\"message\":\"all mandatory: true\",\"timestamp\":\"2025-02-11T12:43:21.292Z\"}", "source_type":"file","timestamp":"2025-02-12T04:49:55.885440369Z"}

My program.vrl file looks like this -

# cat program.vrl1

.file = parse_regex!(.file, r'[^/]*$')

---

In my output I always get "file" tag as blank-

# vector vrl --input input.json --program program.vrl1 --print-object
2025-02-19T09:03:27.106999Z  INFO vector::app: Log level is enabled. level="info"
{ "file": {  }, "hostname": "ab126310fc26", "message": "{\"level\":\"info\",\"message\":\"all mandatory: true\",\"timestamp\":\"2025-02-11T12:43:21.292Z\"}", "source_type": "file", "timestamp": "2025-02-12T04:49:55.885440369Z" `}`

am I missing something here? To me it feels like soemthing which should work.

[pront]

Parse regex used https://docs.rs/regex/latest/regex/struct.Regex.html#method.capture_names internally and without a name, it will not use the result. If you passed numeric_groups: true, you would see

{ "0": "service-manager.log" }

Here's how it works: playground

.file = parse_regex!(.file, r'.*/(?P<name>[^/]+)$').name
.other = parse_regex!(.file, r'[^/]*$', true)."0"