How to use rex for search time field extraction for syslog events?

[smudge797]

Im trying to run a search time query on some syslogs and having issues with the format and Im new to regex.

Below is the format of the logs and Im trying to search and create a table with:

date-time 08/13/2014: 12:50:57 GMT |  UI CMD_EXCECUTED xxxxxxx | User xxxxxxxxxx | Remote_ip xxx.xxx.xxx.xxx

Aug 13 05:50:57 10.185.13.58 08/13/2014: 12:50:57 GMT abcde-abc12-xxxlb01 ABC-0 : UI CMD_EXECUTED 7068686 :  User imuser - Remote_ip 192.168.13.51 - Command "stat ns" - Status "Success"
Aug 13 05:50:43 10.185.13.58 08/13/2014: 12:50:43 GMT abcde-abc12-xxxlb01 ABC-0 : UI CMD_EXECUTED 7068676 :  User s-jfred - Remote_ip 192.168.13.51 - Command "stat ns" - Status "Success"
Aug 13 05:50:29 10.185.13.58 08/13/2014: 12:50:29 GMT abcde-abc12-xxxlb01 ABC-0 : UI CMD_EXECUTED 7068667 :  User ssvcs - Remote_ip 192.168.13.51 - Command "stat ns" - Status "Success"
Aug 13 05:50:14 10.185.13.58 08/13/2014: 12:50:14 GMT abcde-abc12-xxxlb01 ABC-0 : UI CMD_EXECUTED 7068658 :  User v-usser - Remote_ip 192.168.13.51 - Command "stat ns" - Status "Success"
Aug 13 05:50:00 10.185.13.58 08/13/2014: 12:50:00 GMT abcde-abc12-xxxlb01 ABC-0 : UI CMD_EXECUTED 7068648 :  User v-usser2 - Remote_ip 192.168.13.51 - Command "stat ns" - Status "Success"
Aug 13 05:49:45 10.185.13.58 08/13/2014: 12:49:45 GMT abcde-abc12-xxxlb01 ABC-0 : UI CMD_EXECUTED 7068639 :  User v-usser3 - Remote_ip 192.168.13.51 - Command "stat ns" - Status "Success"
Aug 13 05:49:31 10.185.13.58 08/13/2014: 12:49:31 GMT abcde-abc12-xxxlb01 ABC-0 : UI CMD_EXECUTED 7068629 :  User v-usser4 - Remote_ip 192.168.13.51 - Command "stat ns" - Status "Success"
Aug 13 05:49:17 10.185.13.58 08/13/2014: 12:49:17 GMT abcde-abc12-xxxlb01 ABC-0 : UI CMD_EXECUTED 7068619 :  User v-usser5 - Remote_ip 192.168.13.51 - Command "stat ns" - Status "Success"
Aug 13 05:49:03 10.185.13.58 08/13/2014: 12:49:02 GMT abcde-abc12-xxxlb01 ABC-0 : UI CMD_EXECUTED 7068610 :  User v-usser6 - Remote_ip 192.168.13.51 - Command "stat ns" - Status "Success"

Thanks!

[tom_frotscher · Accepted solution]

It should be something like this:

rex "(?<date_time>\d\d\/\d\d\/\d\d\d\d:\s\d\d:\d\d:\d\d\s\w{3}).*UI\sCMD_EXECUTED\s(?<cmd_executed>\d+)\s.*User\s(?<user>\w+)\s-\sRemote_ip\s(?<remote_ip>\d+\.\d+\.\d+\.\d+)"

It is always a good idea to use a regex tester, that are available in the web, to build your regex for the field extractions.

[smudge797]

Great, works like a champ!

[somesoni2]

In case the above doesn't work, try changing "(?\w+)" with "(?[^\s]+)".