Hello,
I have this log:
07-Mar-2013 18:44:17.540 client 172.16.30.10#47729: query: www.atlas.cz IN A + (172.16.30.10)
07-Mar-2013 18:44:17.540 client 172.16.30.7#49729: query: www.seznam.cz IN A + (172.16.30.10)
and I need to extract two fields, client and query:
I have regex for client and query extraction but I dont know how to extract it once.
For query:
(?i) query: (?P<query>[^ ]+)
For client:
(?i) client (?P<client>[^#]+)
Thanks for help
You can use an inline rex:
search | rex field=_raw "client\s*(?<clientip>[^#]*)\d+:\s*query:\s*(?<query>[^\s]*)"
You can use a props extract in props.conf
[sourcetype]
EXTRACT-thosefields = client\s*(?<clientip>[^#]*)\d+:\s*query:\s*(?<query>[^\s]*)
You can do it using props/transforms.
in props.conf
[sourcetype]
REPORT-thosefields = thosefields_for_sourcetype
in transforms.conf
[thosefields_for_sourcetype]
REGEX = client\s*([^#]*)\d+:\s*query:\s*([^\s]*)
FORMAT = clientip::$1 query::$2
Apparently, the #
is special to python regex. Try this: client\s*(\d+\.\d+\.\d+\.\d+)\#\d*:\s*query:\s*([^\s]*)
It doesn work. If I try this:
source="/var/log/named/bind.log" | rex field=_raw "client\s*(?
it shows empty table