Multiple fields extractions

[rexcze]

Hello,

I have this log:

07-Mar-2013 18:44:17.540 client 172.16.30.10#47729: query: www.atlas.cz IN A + (172.16.30.10)
07-Mar-2013 18:44:17.540 client 172.16.30.7#49729: query: www.seznam.cz IN A + (172.16.30.10)

and I need to extract two fields, client and query:
I have regex for client and query extraction but I dont know how to extract it once.

For query:

(?i) query: (?P<query>[^ ]+)

For client:

(?i) client (?P<client>[^#]+)

Thanks for help

[alacercogitatus]

You can use an inline rex:

search | rex field=_raw "client\s*(?<clientip>[^#]*)\d+:\s*query:\s*(?<query>[^\s]*)"

You can use a props extract in props.conf
[sourcetype]
EXTRACT-thosefields = client\s*(?<clientip>[^#]*)\d+:\s*query:\s*(?<query>[^\s]*)

You can do it using props/transforms.

in props.conf

[sourcetype]
REPORT-thosefields = thosefields_for_sourcetype

in transforms.conf

[thosefields_for_sourcetype]
REGEX = client\s*([^#]*)\d+:\s*query:\s*([^\s]*)
FORMAT = clientip::$1 query::$2

[alacercogitatus]

Apparently, the # is special to python regex. Try this: client\s*(\d+\.\d+\.\d+\.\d+)\#\d*:\s*query:\s*([^\s]*)

[rexcze]

It doesn work. If I try this:

source="/var/log/named/bind.log" | rex field=_raw "client\s*(?[^#])\d+:\s*query:\s(?[^\s]*)"|table query clientip

it shows empty table