Skip to content

Commit 64d4338

Browse files
evazorrojinatdatadogmaycmlee
authored
[DOCS-11875] Add regex section to DDSQL reference (#31265)
* [DOCS-11875] Add regex section to DDSQL reference * Remove use of passive voice * Update content/en/ddsql_reference/_index.md Co-authored-by: May Lee <[email protected]> * Update link list and clarify global flag --------- Co-authored-by: jinatdatadog <[email protected]> Co-authored-by: May Lee <[email protected]>
1 parent 9fd1f9f commit 64d4338

File tree

1 file changed

+115
-26
lines changed

1 file changed

+115
-26
lines changed

‎content/en/ddsql_reference/_index.md

Lines changed: 115 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@ DDSQL is SQL for Datadog data. It implements several standard SQL operations, su
2525
This documentation covers the SQL support available and includes:
2626
- [Syntax compatible with PostgreSQL](#syntax)
2727
- [SQL functions](#functions)
28+
- [Regular expressions](#regular-expressions)
2829
- [Window functions](#window-functions)
2930
- [JSON functions](#json-functions-and-operators)
3031
- [Table functions](#table-functions)
@@ -118,9 +119,6 @@ The following SQL functions are supported. For Window function, see the separate
118119
| `TO_TIMESTAMP(string timestamp, string format)` | timestamp | Converts a string to a timestamp according to the given format. |
119120
| `TO_CHAR(timestamp t, string format)` | string | Converts a timestamp to a string according to the given format. |
120121
| `DATE_TRUNC(string unit, timestamp t)` | timestamp | Truncates a timestamp to a specified precision based on the provided unit. |
121-
| `REGEXP_LIKE(string s, pattern p)` | Boolean | Evaluates whether a string matches a regular expression pattern. |
122-
| `REGEXP_MATCH(string s, pattern p)` | array of strings | Returns substrings of the first pattern match in the string. |
123-
| `REGEXP_REPLACE(string s, pattern p, string replacement [, string flags ])`| string | Replaces the first occurrence of the pattern in a string with the replacement. Optional `flags` argument, add `'g'` (global) to match all occurrences instead of first. |
124122
| `CARDINALITY(array a)` | integer | Returns the number of elements in the array. |
125123
| `ARRAY_POSITION(array a, typeof_array value)` | integer | Returns the index of the first occurrence of the value found in the array, or null if value is not found. |
126124
| `STRING_TO_ARRAY(string s, string delimiter)` | array of strings | Splits the given string into an array of strings using the given delimiter. |
@@ -369,28 +367,6 @@ FROM
369367
events
370368
{{< /code-block >}}
371369

372-
### `REGEXP_LIKE`
373-
{{< code-block lang="sql" >}}
374-
SELECT
375-
*
376-
FROM
377-
emails
378-
WHERE
379-
REGEXP_LIKE(email_address, '@example\.com$')
380-
{{< /code-block >}}
381-
382-
### `REGEXP_MATCH`
383-
{{< code-block lang="sql" >}}
384-
SELECT
385-
REGEXP_MATCH('abc123xyz', '[0-9]+')
386-
{{< /code-block >}}
387-
388-
### `REGEXP_REPLACE`
389-
{{< code-block lang="sql" >}}
390-
SELECT
391-
REGEXP_REPLACE('2025-07/29', '-', '/')
392-
{{< /code-block >}}
393-
394370
### `CARDINALITY`
395371
{{< code-block lang="sql" >}}
396372
SELECT
@@ -438,9 +414,117 @@ FROM
438414

439415
{{% /collapse-content %}}
440416

417+
## Regular expressions
418+
419+
### Flavor
420+
421+
All regular expression (regex) functions use the International Components for Unicode (ICU) flavor:
422+
423+
- [Metacharacters][5]
424+
- [Operators][6]
425+
- [Set Expressions (Character Classes)][7]
426+
- [Flag Options for in-pattern flags][8]. Refer to the [flags section below](#function-level-flags) for function-level flags.
427+
- [Find and Replace (using capture groups)][9]
428+
429+
### Functions
430+
431+
| Function | Return Type | Description |
432+
|------------------------------------------------------------------------------------------------------------------|------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
433+
| `REGEXP_LIKE(string input, string pattern)` | Boolean | Evaluates whether a string matches a regular expression pattern. |
434+
| `REGEXP_MATCH(string input, string pattern [, string flags ])` | array of strings | Returns substrings of the first pattern match in the string. <br><br> This function searches the input string using the given pattern and returns captured substrings (capture groups) from the first match. If no capture groups are present, returns the full match. |
435+
| `REGEXP_REPLACE(string input, string pattern, string replacement [, string flags ])` | string | Replaces the substring that is the first match to the pattern, or all such matches if you use the [optional `g` flag](#function-level-flags). |
436+
| `REGEXP_REPLACE (string input, string pattern, string replacement, integer start, integer N [, string flags ] )` | string | Replaces the substring that is the Nth match to the pattern, or all such matches if `N` is zero, starting from `start`. |
437+
438+
{{% collapse-content title="Examples" level="h3" %}}
439+
440+
### `REGEXP_LIKE`
441+
{{< code-block lang="sql" >}}
442+
SELECT
443+
*
444+
FROM
445+
emails
446+
WHERE
447+
REGEXP_LIKE(email_address, '@example\.com$')
448+
{{< /code-block >}}
449+
450+
### `REGEXP_MATCH`
451+
{{< code-block lang="sql" >}}
452+
SELECT regexp_match('foobarbequebaz', '(bar)(beque)');
453+
-- {bar,beque}
454+
455+
SELECT regexp_match('foobarbequebaz', 'barbeque');
456+
-- {barbeque}
457+
458+
SELECT regexp_match('abc123xyz', '([a-z]+)(\d+)(x(.)z)');
459+
-- {abc,123,xyz,y}
460+
{{< /code-block >}}
461+
462+
### `REGEXP_REPLACE`
463+
{{< code-block lang="sql" >}}
464+
SELECT regexp_replace('Auth success token=abc123XYZ789', 'token=\w+', 'token=***');
465+
-- Auth success token=***
466+
467+
SELECT regexp_replace('status=200 method=GET', 'status=(\d+) method=(\w+)', '$2: $1');
468+
-- GET: 200
469+
470+
SELECT regexp_replace('INFO INFO INFO', 'INFO', 'DEBUG', 1, 2);
471+
-- INFO DEBUG INFO
472+
{{< /code-block >}}
473+
474+
{{% /collapse-content %}}
475+
476+
### Function-level flags
477+
478+
You can use the following flags with [regular expression functions](#regular-expressions):
479+
480+
`i`
481+
: Case-insensitive matching
482+
483+
`n` or `m`
484+
: Newline-sensitive matching
485+
486+
`g`
487+
: Global; replace _all_ matching substrings rather than only the first one
488+
489+
{{% collapse-content title="Examples" level="h3" %}}
490+
491+
### `i` flag
492+
493+
{{< code-block lang="sql" >}}
494+
SELECT regexp_match('INFO', 'info')
495+
-- NULL
496+
497+
SELECT regexp_match('INFO', 'info', 'i')
498+
-- ['INFO']
499+
{{< /code-block >}}
500+
501+
### `n` flag
502+
503+
{{< code-block lang="sql" >}}
504+
SELECT regexp_match('a
505+
b', '^b');
506+
-- NULL
507+
508+
SELECT regexp_match('a
509+
b', '^b', 'n');
510+
-- ['b']
511+
{{< /code-block >}}
512+
513+
### `g` flag
514+
515+
{{< code-block lang="sql" >}}
516+
SELECT icu_regexp_replace('Request id=12345 completed, id=67890 pending', 'id=\d+', 'id=XXX');
517+
-- Request id=XXX completed, id=67890 pending
518+
519+
SELECT regexp_replace('Request id=12345 completed, id=67890 pending', 'id=\d+', 'id=XXX', 'g');
520+
-- Request id=XXX completed, id=XXX pending
521+
{{< /code-block >}}
522+
523+
{{% /collapse-content %}}
524+
441525
## Window functions
442526

443-
This table provides an overview of the supprted window functions. For comprehensive details and examples, see the [PostgreSQL documentation][2].
527+
This table provides an overview of the supported window functions. For comprehensive details and examples, see the [PostgreSQL documentation][2].
444528

445529
| Function | Return Type | Description |
446530
|-------------------------|-------------------|------------------------------------------------------------------------|
@@ -562,3 +646,8 @@ ON da.tags = de.tags -- for a specific tag: da.tags->'app' = de.tags->'app'
562646
[2]: https://www.postgresql.org/docs/current/functions-window.html
563647
[3]: https://www.postgresql.org/docs/current/functions-json.html
564648
[4]: /ddsql_editor/
649+
[5]: https://unicode-org.github.io/icu/userguide/strings/regexp.html#regular-expression-metacharacters
650+
[6]: https://unicode-org.github.io/icu/userguide/strings/regexp.html#regular-expression-operators
651+
[7]: https://unicode-org.github.io/icu/userguide/strings/regexp.html#set-expressions-character-classes
652+
[8]: https://unicode-org.github.io/icu/userguide/strings/regexp.html#flag-options
653+
[9]: https://unicode-org.github.io/icu/userguide/strings/regexp.html#find-and-replace

0 commit comments

Comments
 (0)