I have the following log statement and I would like to retrieve the mac address which is a 12 digit string from it.
msgType=notifications notification={"device":"mac:Ab12Cd34nm67","cam":"{\"mac\":\"Ab:12:Cd:34:nm:67\",\"Number\":\"AAAAAAAAA\",.....}"}
I tried with
host=host* source="source.log" "msgType=notifications*" | rex "(?<mac:.{12})>"
I'm looking for the string mac:Ab12Cd34nm67
. How can change the regex to obtain the expected string?
Try like this updated
host=host* source="source.log" "msgType=notifications*" | rex "mac\:(?<mac>.{12})"
There seems to be an issue with the regex statement because it shows Premature end of data in tag form line 1
when I try to use it
Yeah.. missed removing a >
. Try the updated answer.
tried using host=host* source="source.log" "msgType=notifications*" | rex "mac:(?<mac_number>)" | stats count by mac_number
doesn't give me any results