How to extract the field for the below sample ESA logs.
Sun Jun 11 17:33:36 2017 Info: Double bounce: MID 112011 to 0 - 5.1.2 - Bad destination host 'DNS Hard Error looking up abc.com (MX): KKDOMAIN'
Sun Jun 11 10:30:23 2017 Info: Double bounce: MID 221212 to 0 - 5.4.7 - Delivery expired (message too old) [Default] 451-'Open is not allowed please check'
I need the
field1="Bad destination host" & "Delivery expired (message too old) "
field2="'DNS Hard Error looking up abc.com (MX): KKDOMAIN" & "Open is not allowed please check"
based on the provided examples and based on my assumption that
field1 always has the MID 112011 and
field2 has the MID 221212 you can use this regex:
Hope this helps ...
Updated after comment ...
HI Mus, Thanks for the solution. Is there a way to update this for all values not only 5.1.2 Or 5.4.7, it has different values.
If you want to have them all in the same field name, Yes. Otherwise you would have to use different field names and therefore different regex's for each
5.4.7 like number. So for example for matches into one field name you can use this:
or you use
transforms.conf like this:
[mySourceType] REPORT-myDynamicFieldName = myDynamicFieldName
[myDynamicFieldName] REGEX = MID\s\d+\sto\s\d+\s-\s(\d\.\d\.\d)\s-\s([^\r\n]+) FORMAT = fieldname_$1::$2
This will create a dynamic field name like
fieldname_5.4.7 in search time ...
Maybe this helps?