Help with regex to print the value Total_bytes_recv and Total_bytes_send from log

[sarbankumar]

Log:

Aug 28 17:46:20 192.168.111.14 08/28/2019:16:46:18 GMT 0-PPE-0 : default TCP OTHERCONN_DELINK 1091143 0 : Source 192.168.2.166:19301 - Vserver 192.168.2.165:22 - NatIP 192.168.2.166:19301 - Destination 192.168.2.165:22 - Delink Time 08/28/2019:16:46:18 GMT **Total_bytes_send** 2333 - Total_bytes_recv **3173**

[gcusello]

Hi diogofgm,
you can use only one regex:

Total_bytes_send\*\*\s+(?<Total_bytes_send>\d+)\s+-\s+Total_bytes_recv\s+\*\*(?<Total_bytes_recv>\d+)

as you can test at https://regex101.com/r/3A8TRw/1

Bye.
Giuseppe

[diogofgm]

I know. But since the OP only posted one event and not I don't know all the variations of events containing these fields, using separate regexes is less risky since it will work on any event regardless the field order or position and its not really impacting performance doing with separate regexes.

[diogofgm · Accepted solution]

Use this

|rex "Total_bytes_send (?<total_bytes_send>\d+)"
|rex "Total_bytes_recv (?<total_bytes_recv>\d+)"

[sarbankumar]

Total_bytes_send 2333 - Total_bytes_recv 3173

Quoted is the value of total_bytes_send and total_bytes_recv

[sarbankumar]

thanks it works.

[Sukisen1981]

hi @sarbankumar please try @diogofgm 's answer...it works 🙂 Please accept the answer if it works for you