Hello I have the below sample events
Thu Sep 5 10:00:02 EDT 2019 XDB EXPIRED & LOCKED 28-SEP-11 CTXAPP
Thu Sep 5 10:00:02 EDT 2019 VWEinsnte3345 LOCKED GPW_READ
Thu Sep 5 10:00:02 EDT 2019 SK_RYT LOCKED(TIMED) CDS_SELECT_ALL
I want to extract XDB , VWEinsnte3345 ,SK_RYT AS USERNAME and EXPIRED & LOCKED , LOCKED , LOCKED(TIMED) as status , 28-SEP-11 as expiry date(this field is not there for all events) and CTXAPP , GPW_READ , CDS_SELECT_ALL as ROLE
Below is the regex I am using but this is only extracting for event 2
EDT\s\d*\s(?<USERNAME>[^\s]+)\s*(?<STATUS>[^ ]+)\s*(?<ROLE>[^ ]+)
Thanks in advance
Hi vrmandadi,
you could try to use two regexes to extract fields:
| rex "EDT\s\d*\s(?<USERNAME>[^\s]+)\s*(?<STATUS>.*)\s+(?<ROLE>[^ ]+)$"
| rex field=STATUS "(?<STATUS1>.*)\s+(?<expity_date>\d+-\w+-\d+)"
| eval STATUS=coalesce(STATUS1, STATUS)
The second regex runs with events with expiry date and the second one with events without it.
You can test the first regex in https://regex101.com/r/oNrmd0/1 and the second one in https://regex101.com/r/oNrmd0/2
Bye.
Giuseppe
Hi vrmandadi,
you could try to use two regexes to extract fields:
| rex "EDT\s\d*\s(?<USERNAME>[^\s]+)\s*(?<STATUS>.*)\s+(?<ROLE>[^ ]+)$"
| rex field=STATUS "(?<STATUS1>.*)\s+(?<expity_date>\d+-\w+-\d+)"
| eval STATUS=coalesce(STATUS1, STATUS)
The second regex runs with events with expiry date and the second one with events without it.
You can test the first regex in https://regex101.com/r/oNrmd0/1 and the second one in https://regex101.com/r/oNrmd0/2
Bye.
Giuseppe
Thanks Much
Try this
EDT\s\d*\s(?<USERNAME>[^\s]+)\s*(?<STATUS>\w+( & \w+)?)\s*(?<EXPIRY>\d+-[A-Z]+-\d+)?\s*(?<ROLE>[A-Za-z0-9_-]+)
regex101.com is your friend.
Hello @DalJeanis I tried your regex but it did not work .I did try that in regex101 but it is not capturing everything for EXPIRY the values are 28-SEP-1 and ROLE has 1 which should be 28-SEP-11 and CTXAPP respectively .
The same with event 2 the status has value LOCKE and ROLE has D
is that your entire event? if not then could pls share the entire event?