topic Re: How to filter out messages to nullQueue that contain stringA, but keep messages that contain both stringB and stringA? in Getting Data In

How to filter out messages to nullQueue that contain stringA, but keep messages that contain both stringB and stringA?

Volto — Wed, 08 Jun 2016 21:40:29 GMT

Hi,

We are filtering messages from our Cisco ASA logs that contain Teardown and Buildup, but we recently wanted to include messages that include SYN Timeout.

The problem with the messages that contain the SYN Timeout also contain Teardown, which are getting filtered out by our transforms.conf file.

My question: Is there a way for us to filter out the messages that contain Teardown, but keep the messages that keep SYN Timeout even though they contain the Teardown string?

Re: How to filter out messages to nullQueue that contain stringA, but keep messages that contain both stringB and stringA?

woodcock — Thu, 09 Jun 2016 06:02:24 GMT

I do not know the format of your logs but let us suppose it is something like this:

timestamp blah blah SYN Timeout blah blah Teardown blah blah

Then you can use a negative lookahead like this in transforms.conf to throw away ones with SYN Timeout but not Teardown:

[setnull]
REGEX = SYN Timeout(?!.*Teardown)
DEST_KEY = queue
FORMAT = nullQueue

Re: How to filter out messages to nullQueue that contain stringA, but keep messages that contain both stringB and stringA?

Volto — Thu, 09 Jun 2016 12:56:21 GMT

The log format looks like this;

blah blah blah Teardown blah blah blah SYN Timeout

I ended up using a regex like this for matching those that contained Teardown, which we wanted to throw away, but keep that had SYN Timeout, which we wanted to keep.

\s+(Teardown(?!.*SYN\sTimeout))\s+