Help in parsing Avamar Logs

[ansif]

Hi All,

Please help me to parse this event into key value pair:

Timestamp Hostname and Field name in angle bracket and values

Jul  8 22:02:05 RXXXXXXX001 MCS:BS:    <Code> 30900 <Type> WARNING    <Severity> PROCESS <Category>    APPLICATION <User> root <HwSource>    RXXXXXXX001 <Summary> Activity failed
   - timed out before completion. <Group> SQL_Transaction_Logs_4_Hours    <Action> Scheduled Backup    <status_code> 30900 <starttime>    2019-07-08 23:00:00 <targetCid>    8exxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx9    8xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx9    <account_name>    rxxxxxxxxxxx.xx.xxxxxxx.com <client>    /clients/rxxxxxxxxxxx.xx.xxxxxxx.com    <bytes_modified_sent> 0 <client_name>    rxxxxxxxxxxx.xx.xxxxxxx.com    <errorcode> 10019 <CID>    8exxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx9    <hard_limit> 0 <retention_policy>    14_Days <bytes_protected> 0 <endtime>    2019-07-09 0 3:02:05 <PID> SQL    <plugin_name> Windows SQL    <snapup_number>  <snapup_label>     <schedule> Transaction log 4 HR    <bytes_scanned> 1 <WID> Transaction    log 4 HR-SQL_Transactio    n_Logs_4_Hours-1562626800005 <domain>    /clients <dataset> /Transactional_Log    _4_Hours <account> /clients/rxxxxxxxxxxx.xx.xxxxxxx.com

[FrankVl · Accepted solution]

Assuming field values do not contain <> characters, this should be fairly straightforward using props and transforms like so:

props.conf (make sure to set the sourcetype to what you actually use)

[avamar:syslog]
REPORT-key_value_extract = avamar_key_value_extract

transforms.conf

[avamar_key_value_extract]
REGEX = \<([^>]+)\>\s+([^<]*?)\s*(?=\<|$)
FORMAT = $1::$2

https://regex101.com/r/76VHjG/1

You may want to tune the regex a bit, but it is a bit tricky to get a really simple and fast one, that still strips out the spaces around the field values.