topic Re: Extract field values in Getting Data In

Extract field values

shangshin — Thu, 24 Oct 2013 21:32:37 GMT

Hi, I have having the following stanza in transforms.conf

[apache_fields]
DELIMS = "\t"
FIELDS = clientip,remotelogname,user_id,timestamp,resource_requested,http_status_code,content_length,referrer,user_agent,response_time

clientip field value could be 1 or 2 IP separated by comma
10.39.127.164
10.39.127.164, 10.183.135.2

Is it possible to add another stanza so I can extract ip1 and ip2 if it exists.

Thanks in advance!

Re: Extract field values

lukejadamec — Thu, 24 Oct 2013 21:36:03 GMT

So, there is white space for a delimiter, but only a comma between the IPs?

Re: Extract field values

shangshin — Thu, 24 Oct 2013 21:38:44 GMT

yes, the delimiter is comma. I tried to add a new stanza below but it didn't work out. Thank you!

[clientip]
DELIMS = ", "
FIELDS = aip1, aip2

Re: Extract field values

richgalloway — Fri, 25 Oct 2013 12:10:42 GMT

Have you considered replacing the DELIMS and FIELDS statements with a REGEX? For example:

[apache_fields]
REGEX = (?<ip1>.*?)(,\s(?<ip2>.*?))?\s(?<remotelogname>.*?)\s(?<user_id>.*?)\s(?<timestamp>.*?)\s(?<resource_requested>.*?)\s(?<http_status_code>.*?)\s(?<content_length>.*?)\s(?<referrer>.*?)\s(?<user_agent>.*?)\s(?<response_time>.*)

Re: Extract field values

shangshin — Fri, 25 Oct 2013 13:35:59 GMT

Thank you. This works!