Formating question and regex

[CYBR_AH]

Hi All,

I'm trying to search for start up and shutdown message of AWS instances and build a nice table. On my test instance, the first message on the /var/log/message is the following line when I run 'earliest=-4h@h "start" | regex _raw="rsyslogd:.*" | table _raw'

Mar 16 14:42:58 ip-10-0-0-2 rsyslogd: [origin software="rsyslogd" swVersion="5.8.10" x-pid="899" x-info="http://www.rsyslog.com"] start

I'd like to break this down and just keep.

_time, IP, Command
timestamp, 10.0.0.2, Start

Am I going about this the wrong way?

[jkat54]

 earliest=-4h@h | rex field=_raw '(?<=swVersion..)(?<swversion>.*)" x-pid=.(?<pid>\d+)" x-info="(?<info>.*)"]' | table swVersion, pid, info

[jkat54]

Hey thanks for the upvote CYBR_AH, if it solved your problem please mark it as the answer too. Cheers!

[somesoni2]

Try something like this (assuming you WANT to display these fields - _time, IP, Command)

earliest=-4h@h "start" | regex _raw="rsyslogd:.*" | rex "ip-(?<IP>\d+-\d+-\d+-\d+)\s[^\]]+\s+(?<Command>.*)" | table _time IP Command