How to extract fields from the logs

[mariamathewtel]

Hi All,

I am having a set of logs from one of my ticketing system.  I want to extract the Host name of the device that caused issue from the description. 

Critical_DISK: ABC - /var is at 99 % .
Critical_DISK: DEF - /var/log is at 85 % .
Critical_DISK: GHI - /var/log is at 90 % .
Critical_DISK: JKL-MNO-PQR - /var/log is at 73 % .
Critical_DISK: JKL-MNO-PQR - /var/log is at 85 % .
Critical_DISK: JKL-MNO-PQR - /var/log is at 87 % .
Critical_DISK: hkgtelpac-sg1.hkg2.oss - /var/log is at 85 % .
[VMware vCenter - Alarm alarm.HostConnectivityAlarm] Host abcdefgh.in.reach.com in TGCN_PAD is not responding
[zenoss] AB-CD-EFG 10.111.122.33 is DOWN!
[zenoss] QWERTYU disk space threshold: 98.1% used (8.1GB free)
[zenoss] asedfrt 10.20.30.40 is DOWN!

These are some sample description. 

I used this rex statement : | rex field=_raw "^[^\\]\\n]*\\]\\s+(?P<HostName>\\w+)" 
but it is not properly extracting the hostname. 

Can someone please help me with this. 

[richgalloway]

Try this rex command.

| rex "[:\]]\s(?:Host\s)?(?<HostName>\S+)"

[richgalloway]

Which part of those events (I assume they're separate events) is the host name?  I see at least 3 different ways to identify the host.

[mariamathewtel]

Hi @richgalloway ,

Thanks for the reply. Host names are the highlighted bold ones. 

Critical_DISK: ABC - /var is at 99 % .
Critical_DISK: DEF - /var/log is at 85 % .
Critical_DISK: GHI - /var/log is at 90 % .
Critical_DISK: JKL-MNO-PQR - /var/log is at 73 % .
Critical_DISK: JKL-MNO-PQR - /var/log is at 85 % .
Critical_DISK: JKL-MNO-PQR - /var/log is at 87 % .
Critical_DISK: hkgtelpac-sg1.hkg2.oss - /var/log is at 85 % .
[VMware vCenter - Alarm alarm.HostConnectivityAlarm] Host abcdefgh.in.reach.com in TGCN_PAD is not responding
[zenoss] AB-CD-EFG 10.111.122.33 is DOWN!
[zenoss] QWERTYU disk space threshold: 98.1% used (8.1GB free)
[zenoss] asedfrt 10.20.30.40 is DOWN!