Is it possible to strip text out of a field for better reporting

[richfoster]

I am looking to strip out some text from a field in my log file and have no knowledge of regex to do it. What I would like is the get "richf" out of the following entry by setting up a field "loguser" then removing "logname" from it. I have lots of other linux machines that use the field "user" and have a diferent format when searching for "richf" in the interactive field editor "user" and "richf" are highlighted and not the logname=richf.

May 30 12:02:58 revmq su: pam_unix(su-l:auth): authentication failure; logname=richf uid=502 euid=0 tty=pts/1 ruser=richf rhost= user=root
May 30 12:02:56 revmq sshd[5165]: pam_unix(sshd:session): session opened for user richf by (uid=0)
May 30 12:02:56 revmq sshd[5165]: Accepted password for richf from 10.77.113.237 port 5718 ssh2

[wpreston]

Sure, this can be done. Use the rex command followed by a regular expression to extract the fields you need. Try this:

your search or * | rex "(opened\sfor\suser\s|password\sfor\s)(?<User>[^\s]+)" | rex "logname=(?<Logname>[^\s])"

You can see what all is extracted by appending this at the end of the above search: | stats values User Logname. I don't know if it will cover all of your cases for extracting User, but it should work for the ones provided in the question. Another way to get your Logname extraction is to use automatic field extraction since it is in field=value format, but that won't work with your User extraction.

Also, here is a great place to get started learning regular expressions: http://www.regular-expressions.info

I use this website to test my regexes: http://rubular.com/