Field Extraction - Trim Existing Field

[jchampagne]

In some of our event logs, the client IP address is recorded with leading information (::ffff:). I would like to trim this data and create a new field, which I can then do a reverse dns lookup on using a scripted lookup.

I'm not looking to modify the index, I'd like all of this to happen at search time.
The field I'm looking to modify is called Client_Address and a sample value would be:
::ffff:192.168.207.88

If I use the following REX at search time, I get a new field called Client_IP that looks good:
rex field=Client_Address "(?\b\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}\b)"

However, I'd like to use props.conf so this all happens automatically. If I add the following line to my WinEventLog:Security stanza, it doesn't work.

EXTRACT-ClientIP = rex field=Client_Address "(?\b\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}\b)"

[MHibbin · Accepted solution]

Firstly you don't need the rex part that is a search command.

You should look at the props.conf spec file.

Try something like

EXTRACT-ClientIP = [:,f]*(?<ip>\d+\.\d+\.\d+\.\d+)

OR

EXTRACT-ClientIP = [:,f]*(?<ip>\d{1,3}\.\{1,3}\.\d{1,3}\.\d{1,3})

Or you can just use the Interactive Field Extractor to help with the config of the props.conf (if you do the regex in IFX and save it, it will do the file itself.

[MHibbin]

no worries... what's with the "b" in your regex?

[jchampagne]

Thanks for the help!
I ended up using the following line, which seems to work.

EXTRACT-ClientIP = (?\b\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}\b)