How can I extract attachments?

[treven]

I am attempting to extract attachment fields from our email logs using regex. Attachments like .jpg, .png, pdf, etc. I have gone through the process of using the SPL field extracting feature however it usually results in only one attachment type being selected or another, if I try and select other attachment types the extraction fails. Any suggestions would be greatly appreciated. Thank you. 

[treven]

@gcusello 

That did it! Thank you very much for your assistance with this! 

[treven]

So, I was able to get the field extractor to do both png and jpg but any other selected field results in an error. I suppose I could create separate fields and use eval to somewhat accomplish what I am looking for. 

Here are some examples: 

date=2023-07-28 time=09:00:22.791 device_id=10000 log_id=000123 type=spam subtype=default pri=information  session_id="1138-7644" client_name="" client_ip="1.1.1.1" dst_ip="1.1.1.1" from="email" to="email" subject="TITLE" msg="Antispam identified spam URL: http://website.jpg"

date=2023-07-28 time=08:51:25.640 device_id=02222 log_id=00023 type=virus subtype=sandbox pri=information  from="" to="" client_name="" client_ip="" session_id="1000-0322" msg="File file.pdf has been sent to Sandbox"

[gcusello · Accepted solution]

Hi @treven,

maybe this regex could work for you:

| rex "(?<file>\w+\.(jpg|pdf|png))"

that you can test at https://regex101.com/r/ol040L/1

Ciao.

Giuseppe

[treven]

@gcusello ,

This worked really well! Thank you very much for your assistance!

[treven]

Yeah absolutely, I will post it soon. Thanks for your assistance. 

[gcusello]

Hi @treven,

I suppose that you're speaking to extract the file name of the attachment, not the attachment file itself!

Anyway, the field extraction should already be present in the Add-On you're using, if not, please share a sample of your logs, highlighting in bold the data to extract.

Ciao.

Giuseppe

[treven]

Yes that is correct I am just looking to monitor the various types of attachment types. As I stated in my post, the field extracting feature is only allowing one type of attachment. It will only extract .jpg fields and will ignore pdf or png. If I try to add another by selecting it in an event, I will get an error. 

[gcusello]

Hi @treven,

ok, could you share a sample (in text format) of your logs (eventually masking data)?

Ciao.

Giuseppe