Here is the regex to extract message_type based on CIM. Could anyone make this faster than 1387 steps?
Here is the sample syslog for DNS.
Feb 3 00:42:32 FSTAd2346.g.ae3.dns.mil tmm 2021-02-03 00:42:32 FSTAd2346.g.ae3.dns.mil qid 26818 from 10.130.27.34#13258: view none: query: a-grv-gocdzace.g.ae3.dns.mil IN A + (10.130.44.87%0)
Feb 3 00:42:32 FSTAd2346.g.ae3.dns.mil tmm 2021-02-03 00:42:32 FSTAd2346.g.ae3.dns.mil qid 57035 to 10.130.27.34#13258: [NOERROR qr,aa,rd] response: a-grv-gocdzace.g.ae3.dns.mil
This executes with 50 steps with the given sample data.
View solution in original post
Unless you really need to have the [\.] in the regex, i.e. you want to match any character in front of the word query, other than the '.' character and to include this in your message type then you should use one of the suggestions.
NB, you don't need the \ in front of :
Below is working in 163 steps based on your sample data.