topic Re: Multiple fields extractions in Getting Data In

Multiple fields extractions

rexcze — Thu, 07 Mar 2013 18:15:45 GMT

Hello,

I have this log:

07-Mar-2013 18:44:17.540 client 172.16.30.10#47729: query: www.atlas.cz IN A + (172.16.30.10)
07-Mar-2013 18:44:17.540 client 172.16.30.7#49729: query: www.seznam.cz IN A + (172.16.30.10)

and I need to extract two fields, client and query:
I have regex for client and query extraction but I dont know how to extract it once.

For query:

(?i) query: (?P<query>[^ ]+)

For client:

(?i) client (?P<client>[^#]+)

Thanks for help

Re: Multiple fields extractions

alacercogitatus — Thu, 07 Mar 2013 18:41:42 GMT

You can use an inline rex:

search | rex field=_raw "client\s*(?<clientip>[^#]*)\d+:\s*query:\s*(?<query>[^\s]*)"

You can use a props extract in props.conf
[sourcetype] EXTRACT-thosefields = client\s*(?<clientip>[^#]*)\d+:\s*query:\s*(?<query>[^\s]*)

You can do it using props/transforms.

in props.conf

[sourcetype] REPORT-thosefields = thosefields_for_sourcetype

in transforms.conf

[thosefields_for_sourcetype] REGEX = client\s*([^#]*)\d+:\s*query:\s*([^\s]*) FORMAT = clientip::$1 query::$2

Re: Multiple fields extractions

rexcze — Mon, 28 Sep 2020 13:29:21 GMT

It doesn work. If I try this:

source="/var/log/named/bind.log" | rex field=_raw "client\s*(?[^#])\d+:\s*query:\s(?[^\s]*)"|table query clientip

it shows empty table

Re: Multiple fields extractions

alacercogitatus — Mon, 11 Mar 2013 16:32:25 GMT

Apparently, the # is special to python regex. Try this: client\s*(\d+\.\d+\.\d+\.\d+)\#\d*:\s*query:\s*([^\s]*)