Field extraction from Windows eventlog

gltplus — Fri, 06 Jul 2018 10:01:02 GMT

Windows eventlog are indexed fine.
A particulare evnetlog source "WinEventLog:Application Info" (mind the space) contains the normale message field.

Inside this message field I want to extra a hostname.

sourcetype="WinEventLog:Application Info" | rex field=Message "regex query"(?....) more regex" works all fine. Hostname are captured.

Now I really need this to be done from the props.conf.

I created in the props.conf

["WinEventLog:Application Info"]
EXTRACT-Hostname = same regex as above

But this doesn't seem to work? I'm I missing something?
Something wrong with the sourcetype name (mind the space)?

Re: Field extraction from Windows eventlog

493669 — Fri, 06 Jul 2018 10:14:45 GMT

it seems that you have added double quotes for source so try without quotes like below:

[WinEventLog:Application Info]
EXTRACT-Hostname = <your regex>