rex everything after 8th whitespace

[subtrakt]

2014-02-01T14:51:24.601752+00:00 .foo.com 21470: Feb 1 14:51:23.570 GMT: %SEC-6-IPACCESSLOGP:

I looked around but couldn't find a rex query to extract the actual Syslog message which would be after the 8th colon in the above message or 8th whitespace will also work.

rex generator isn't giving the desired results.

Thanks in advance for any help.

[mikaelbje]

This field has already been extracted and is called "message_text". If you want to do some magic on the contents of it, just reference that field from the rex command instead of _raw.

I wouldn't recommend you to do a rex after the 8th colon as there is no guarantee there will be eight colons in a IOS syslog message. It all depends on how the logging from the device is set up.

Regards,

Mikael

Author of the Cisco IOS app

[martin_mueller · Accepted solution]

You could prefix the expression with one that matches eight whitespaces:

^(\S*\s){8}(?<everything_after>.*)$

[martin_mueller]

That works the same way, just replace \S with [^:] and \s with :

[subtrakt]

What about after 8th ':'

[martin_mueller]

Right - I had one closing parenthesis too many after {8}... adding one in front works as well of course.

For learning and testing, take a look at http://www.regexr.com/

[subtrakt]

rex ^((\S*\s){8})(?.*)$ --- Added another '(' after '^' and it works like a dream! Thanks! Do you recommend any regex cheatsheets or learning resources?