Field Extraction (rex maybe?)

[a_n]

Hello All,

I am not good in Regular Expressions, I need you assist.

In my data, I have a field containing IPs and Ports but in specific sequence:

...some text ... SourceIP DestIP SrcPort DestPort ....some text...
between them there is one SPACE.
as an example:
message=...w 2-APIS 0-External-1 tcp 10.0.12.13 40.126.31.8 55373 443 msg=\"HTTS...

I need to extract fields for SrcIP, DestIP, SrcPort and DestPort.
when I use

 \b(?:[0-9]{1,3}\.){3}[0-9]{1,3}\b \b(?:[0-9]{1,3}\.){3}[0-9]{1,3}\b \d* \d*

OR

\b(?:[0-9]{1,3}\.){3}[0-9]{1,3} (?:[0-9]{1,3}\.){3}[0-9]{1,3}\b \d* \d*
I can grab the 2 IPs and ports  with spaces between them.
I am confused about how to assign each to a new field.
Can someone help?
Or do I have to use REX for search time extraction?
Even to use REX, I appreciate your advices.

Regards,

-Ali

[a_n]

Thank you @scelikok 

Undersood.

[gcusello]

Hi @a_n,

please try this:

| rex "(?<src_ip>\d+\.\d+\.\d+\.\d+)\s+(?<dest_ip>\d+\.\d+\.\d+\.\d+)\s+(?<src_port>\d+)\s+(?<dest_port>\d+)"

that you can test at https://regex101.com/r/UTRazw/1

if you could share two or three full samples of your logs I could be more precise.

Ciao.

Giuseppe

[a_n]

@gcusello 

Thank you

[a_n]

Dears,
I used this:
(?<srcip>\d+\.\d+\.\d+\.\d+) (?<dstip>\d+\.\d+\.\d+\.\d+) (?<srcpt>\d+) (?<dstpt>\d+)

Seems ok, but does anyone have better idea?

[scelikok · Accepted solution]

Hi @a_n,

You should use captured group on regex. 

rex sample;

| rex field=message "\b(?<src_ip>(?:[0-9]{1,3}\.){3}[0-9]{1,3})\b \b(?<dest_ip>(?:[0-9]{1,3}\.){3}[0-9]{1,3})\b (?<src_port>\d*) (?<dest_port>\d*)"

props.conf extract

EXTRACT-fields = \b(?<src_ip>(?:[0-9]{1,3}\.){3}[0-9]{1,3})\b \b(?<dest_ip>(?:[0-9]{1,3}\.){3}[0-9]{1,3})\b (?<src_port>\d*) (?<dest_port>\d*)