Extract field values

[shangshin]

Hi, I have having the following stanza in transforms.conf

[apache_fields]
DELIMS = "\t"
FIELDS = clientip,remotelogname,user_id,timestamp,resource_requested,http_status_code,content_length,referrer,user_agent,response_time

clientip field value could be 1 or 2 IP separated by comma
10.39.127.164
10.39.127.164, 10.183.135.2

Is it possible to add another stanza so I can extract ip1 and ip2 if it exists.

Thanks in advance!

[richgalloway · Accepted solution]

Have you considered replacing the DELIMS and FIELDS statements with a REGEX? For example:

[apache_fields]
REGEX = (?<ip1>.*?)(,\s(?<ip2>.*?))?\s(?<remotelogname>.*?)\s(?<user_id>.*?)\s(?<timestamp>.*?)\s(?<resource_requested>.*?)\s(?<http_status_code>.*?)\s(?<content_length>.*?)\s(?<referrer>.*?)\s(?<user_agent>.*?)\s(?<response_time>.*)

[shangshin]

Thank you. This works!

[shangshin]

yes, the delimiter is comma. I tried to add a new stanza below but it didn't work out. Thank you!

[clientip]
DELIMS = ", "
FIELDS = aip1, aip2

[lukejadamec]

So, there is white space for a delimiter, but only a comma between the IPs?