Fields Extraction using RegEx

[syazwani]

Hi, i want to extract bytes fields (using the bytes values) from this:

Sep 23 14:11:52 XXX.XXX.X.XX date=2021-09-23 time=14:11:52.004 device_id=FE-3KET123 log_id=6716781232 type=event subtype=smtp pri=information user=mail ui=mail action=NONE status=N/A session_id="47K0CjSc111111-47K0CjSc111111" msg="to=<[email protected]>, delay=00:00:04, xdelay=00:00:04, mailer=esmtp, pri=61772, relay=hotmail-com.olc.protection.outlook.com. [XXX.XX.XX.XXX], dsn=2.0.0, stat=Sent (<[email protected]> [InternalId=32836723661134, Hostname=XXXXXXXXXX.namXXXX.prod.outlook.com] 71422 bytes in 0.303, 229.746 KB/sec Queued mail for delivery -> 250 2.1.5)"

I've already found the regex -    (?<bxmt>\d+) bytes
But it didnt seem to work fine.
Can anyone help?

[ashvinpandey · Accepted solution]

@syazwani Try using the below rex:

| rex field=_raw "InternalId.*\]\s(?<bxmt>\d+?)\sbytes"

Also, If this reply helps you, an upvote would be appreciated.

[ITWhisperer]

It looks OK - how are you using it?

You could try using \s instead of spaces

\s(?<bxmt>\d+)\sbytes