I have an event of the below format from a Firewall Source. I need to extract the field named "FieldChanges" from it. There are multiple fields separated by Pipe where I can use the Delimiter function, but I already have all other fields extracted except the above mentioned field.
Can you help me find a better way of extracting the field values with a Regex or any other alternative?
loc=8270|time=20Sep2018 13:10:57|action=accept|orig=application|i/f_dir=outbound|i/f_name=|has_accounting=0|product=SmartDashboard|ObjectName=Current_Policy_8|ObjectType=firewall_policy|ObjectTable=fw_policies|Operation=Modify Object|Uid={XYZ}|Administrator=xyz|Machine=ABC|FieldsChanges=Rule 132 UID = {sample data} (sample data) Destination: added 'xyz';Rule 113 UID = {SAMPLE DATA} (XYZ) Source: added 'N1XYZ_18_EDC_Network' ;|session_id=kflow Automatic Session|Subject=Object Manipulation|Operation Number=1|client_ip=ABC
Thanks in Advance.
Hi
if you want extract all that there's between "FieldChanges=" and the pipe "|", try this regex:
([^\|]+\|){15}FieldsChanges\=(?<FieldsChanges>[^\|]*)
You can test it at https://regex101.com/r/xrySrr/1
Bye.
Giuseppe
Hi
if you want extract all that there's between "FieldChanges=" and the pipe "|", try this regex:
([^\|]+\|){15}FieldsChanges\=(?<FieldsChanges>[^\|]*)
You can test it at https://regex101.com/r/xrySrr/1
Bye.
Giuseppe