Hi, I want to extract the 'subjects' from my SMTP maillog but the regex I have built doesn't seem to work. I have built the same type of regex to extract the FROM en TO fields and that works so I'm puzzled why it doesn't extract the subjects...
Regex looks like this:
(?i) subject <(?P
Can anyone help me out ? Thanks in advance!
Thx jstockamp - that didn't quite work. I will give more detail in my own question I think. About to go set one up now.
Thanks
Your regex should looking something like this.
Subject.'(?
Hi
Did you get an answer for this - trying to do this myself. My email subjects differ so I want to table them all
How did you end up extracting the subject lines?
Thanks
Sue
Hi Ayn, here is a sample of the logfile, I want to extract the subject:
Mon Jul 2 10:20:38 2012 Info: Start MID 62771585 ICID 33896658
Mon Jul 2 10:20:38 2012 Info: MID 62771585 ICID 33896658 From: <*****>
Mon Jul 2 10:20:38 2012 Info: Delivery start DCID 24405838 MID 62771584 to RID [0]
Mon Jul 2 10:20:38 2012 Info: MID 62771585 ICID 33896658 RID 0 To: <*>
Mon Jul 2 10:20:38 2012 Info: MID 62771585 Message-ID '2B2E0EB229A8F44AB8C55D5E296BCFC40C584F@SCOMP0934.wurnet.nl'
Mon Jul 2 10:20:38 2012 Info: MID 62771585 Subject 'FW: Postbus AgroFood vanaf vrijdag 17:00 VOL: opnieuw inzenden!!'
Mon Jul 2 10:20:38 2012 Info: MID 62771585 ready 19724 bytes from <****>
Mon Jul 2 10:20:38 2012 Info: MID 62771585 matched all recipients for per-recipient policy DEFAULT in the outbound table
Mon Jul 2 10:20:38 2012 Info: MID 62771585 interim AV verdict using Sophos CLEAN
Mon Jul 2 10:20:38 2012 Info: MID 62771585 antivirus negative
have you tried using the "extract fields" dropdown from one of the events?
Please include a log sample. Without it it's hard to build a regex that should match.