Complex regex help

[jlixfeld]

I've tried a few tools to try and write the proper regex syntax to do what I want, but I'm not having any luck.

I have syslog output that comes from two different device types that comes out with different fields whether it's one device type or the other:

Oct  5 09:02:40 10.219.49.2 66772: bfr01.151front711 RP/0/RSP0/CPU0:Oct  5 09:02:40.861 : exec[65706]: %SECURITY-login-6-AUTHEN_SUCCESS : Successfully authenticated user 'rancid' from '10.219.51.130' on 'vty0'
Oct  5 08:12:29 10.219.49.31 146074: bpe01.77mowat506: Oct  5 08:12:28.623: %LINK-3-UPDOWN: Interface Virtual-Access45, changed state to down

The important fields are the hostname which appears in field 6 in both lines and as Cisco calls it "%message-group-severity-message-code" which appears in two different fields depending on the device.

Using the field extrator, I can generate a regex that captures the hostname:

"(?:[^:\n]*:){6}\s+(?P<FIELDNAME1>[^ ]+)"

But I can't figure out how to get field extractor to also capture the %message as a different field. Heck, I can't even get it to reliably match %message in the first place. It doesn't seem to understand when I enter copy and paste different values from two different fields and ask it to match against it.

I'd be grateful of for any assistance.

[gkanapathy · Accepted solution]

Try:

^(?:\S*\s*){5}(?<hostname>\S*)[^%]*(?<message>%\S+)

It could be more precise (e.g., it could define where after the hostname the message occurs, instead of just finding the first %), but should work.

[jlixfeld]

Hi Oliver,

You are partially right. I perhaps didn't make my question clear enough. I apologize. I'd like to match %message as well as hostname. I understand that the field extractor can extract multiple fields at once.

[jlixfeld]

Again, my apologies. The hostname in the example would be either bfr01.151front711 or bpe01.77mowat506.

I tried your second regex, and that works much better, except for one small issue. It matches this as one field:

bfr01.151front711 RP/0/RSP0/CPU0

The one field should only be:

bfr01.151front711

[OL]

Sorry, I'm not sure that I can recognize the hostnames from the log but I'm guessing you want to get "bfr01.151front711 RP/0/RSP0/CPU0" and "bpe01.77mowat506", but would this one be OK:

[^ ]+ [^ ]+ [^ ]+ [0-9]+: (?[^:]+).*: (?%[^:]+):

[OL]

Hello,

From your email I understand that you are trying to collect "%SECURITY-login-6-AUTHEN_SUCCESS" and "%LINK-3-UPDOWN". This is the correct, have you tried this regex:

: (?<FIELDNAME1>%[^:]+):

Hope this help.

Regards,
Olivier