Hi
I would like to list below logline in 4 parts and I'm not sure how to do it in with Regex. The automatic field extractor does not work. Any suggestion on how to write the right regex.
Field1 Field2 Field3 Field4
[AUDIT] [USER_AUTH_SUCCESS] Authentication successfully completed. User: 'Test'
This is an extract out of the field extractor which is not working:
?:[^[n][){3}(?P<fieldname1>[^]]+)[^ n] [(?P<fieldname2>[^]]+)](?P<fieldname3>s+w+s+w+s+w+.)^(?P<fieldname4>s+w+:)
In that case feel free to accept the answer below. Thanks
Perfect ..it works. thanks very much for your help !
Here you go :
* | head 1
| eval message="[AUDIT] [USER_AUTH_SUCCESS] Authentication successfully completed. User: 'Test'"
| table message
| rex field=message "\[(?<field1>[^]]+)\] \[(?<field2>[^]]+)\] (?<field3>.*)\s+User: '(?<field4>.*?)'"
Everything between the two " on the last line is the regex you need to extract the fields
i.e.
\[(?<field1>[^]]+)\] \[(?<field2>[^]]+)\] (?<field3>.*)\s+User: '(?<field4>.*?)'
it's always information about the user
Where does Field4 start ? is it
after a '.'
or
it it always information about the user ?