topic regular expression in Security

regular expression

Siddharthnegi — Tue, 24 Sep 2024 11:27:00 GMT

Hi I want to extract highlighted part

Sep 24 10:43:25 10.82.10.245 [S=217] [BID=d57afa:30] RAISE-ALARM:acProxyConnectionLost: [KOREASBC1] Proxy Set Alarm Proxy Set 1 (PS_ITSP): Proxy lost. looking for another proxy; Severity:major; Source:Board#1/ProxyConnection#1; Unique ID:242; Additional Info1:; [Time:24-09@17:43:25.248] [63380759]

Re: regular expression

gcusello — Tue, 24 Sep 2024 12:07:33 GMT

Hi @Siddharthnegi ,

please try this:

| rex "^\w+\s\d+\s\d+:\d+:\d+\s(?<ip>\d+\.\d+\.\d+\.\d+)"

that you can test at https://regex101.com/r/Ha7ifi/1

Ciao.

Giuseppe

Re: regular expression

Thulasinathan_M — Tue, 24 Sep 2024 12:09:57 GMT

You can use below rex. Which will fetch the highlighted context
| rex "\w+\s+\d+\s+\d{2}:\d{2}:\d{2}\s+(?<result>[^\s]+)"