Extracted field as variable

[quatral]

Hi everyone,

A simple question about the field extractions. Suppose I've got 12 logs with basically some recurrent information, such as IP Addresses, MAC Addresses and Bytes (in or out, whatever).

My question is simple. I know an IPv4 address can be extracted with :

< ?ip_address(\d{1,3}\.){3}\d{1,3} >

Now, I have a extracted field name ip_address that I can set to a sourcetype, a source or a host and use the token * to specify all of them.

But the problem is, what if one of my log as two IP Addresses (let's say the Talker and the Listener). I've already the field ip_address available and it will catch the first IP address, but I'll be force to create an other one that will looks like that :

\d{1,3}\.){3}\d{1,3}.* < ?ip_listener(\d{1,3}\.){3}\d{1,3} >

(Just to know this is an exemple and it may actually not work)

So, my question is, is it possible to use something like :

%ip_address.* < ?ip_listener%ip_address >

instead, where %ip_address is a reference to the extracted field ip_address ?

Sorry for the long post.

[Ayn · Accepted solution]

No, it is not.

[quatral]

Exactly. I want to extract two IP Address in the same event. And sorry for the <, in the viewer the symbol didn't work and the code worked :S

My question is more about create "named regex" and use these named regex in other regex.

[Rob]

Are you looking for the value of the ip_address field or are you looking to reference the regex of the ip_address field?

I am assuming that you want to capture 2 different fields that are in the same event that look like IP addresses and one follows the other?