I’m trying to take a subset of our regular logs and forward them on to another department.
Am I doing this right? Is the RegEx correct? Do I have the right idea here?
So, what I need to do is forward ONLY the logs that have one of the following in them (this is 4 out of hundreds):
group\geo\country1\*
group\geo\country2\*
group\geo\country3\sub1\*
group\geo\country3\sub12\*
This field is already extracted in transforms.conf as “PathAndName”, but includes hundreds of others as well. (It’s the 3rd last field in the current transforms.conf below)
TRANSFORMS.CONF
Already existing extraction in transforms.conf
[test_extractions]
DELIMS = "|"
FIELDS = "EventID","AlertTime","ThreatInstanceID","ActionTaken","country2erName","Scountry1nnerType","ThreatName","Statcountry2","ThreatType","ThreatSubType","ComputerID","FullFilePath","FileNameOffset","Name","DNSName","IPAddress","OperatingSystem","ServicePack","Vircountry2DataVersion","FullFilePathCheckSum","ThreatLocountry1lID","CheckSum","SAVVersion","DomainName","PathAndName","ParentGroup","SophosDB"
Currently I have the following, but it isn’t working, even though it works great in Expresso and RegexBuddy (as well as about 20 other things!):
[test_to_SSIM]
REGEX= (?i)(?<PathAndName>group\\geo\\country2|group\\geo\\country1|group\\geo\\country3\\sub1|group\\geo\\country3\\sub12)
DEST_KEY=_TCP_ROUTING
FORMAT=test_to_SSIM
PROPS.CONF
[source::existing_feed]
TRANSFORMS-routing = test_to_SSIM
OUTPUTS.CONF
[tcpout:test_to_SSIM]
server=xxx.xxx.xxx.xxx:10595
sendCookedData=false
dropEventsOnQueueFull = 10
