How do I extract these two fields from a string in my sample data?

[fbertoletti]

Hello,

I have this logs :

Apr 26 12:49:09 10.30.245.203 Apr 26 14:49:12 MachineOne info tmm1[11869]: Rule /User_Agent <HTTP_RESPONSE>: src_ip=112.43.9.4,vip=110.12.8.8,http_method=GET,http_host=www.xxxx.it:443,http_uri=/files/visio.jpg,http_url=www.xxx.it:443/files/x/x/x/x/x.jpg,http_version=1.1,http_user_agent="Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.112 Safari/537.36",http_content_type=,http_referrer="https://x/",req_start_time=2016/04/26 14:49:12,cookie="_x",user=,virtual_server="/x x x",bytes_in=0,res_start_time=2016/04/26 14:49:12,node=x ,node_port=80,http_status=200,req_elapsed_time=5,bytes_out=13290 

I would like to only extract this part Windows NT 6.1 and Chrome/49.0.2623.112 in the http_user_agent field.

I also have another log with the valuesLinux and Chrome/49.0.2623.105

Apr 26 13:10:16 10.30.245.203 Apr 26 15:10:19 x info tmm[11869]: Rule /User_Agent <HTTP_RESPONSE>: src_ip=x,vip=x8,http_method=GET,http_host=x,http_uri=x,http_url=x,http_version=1.1,http_user_agent="Mozilla/5.0 (**Linux**; Android 4.4.2; LG-D213 Build/KOT49I.A1407976057) AppleWebKit/537.36 (KHTML, like Gecko) **Chrome/49.0.2623.105** Mobile Safari/537.36",http_content_type=,http_referrer="x",req_start_time=2016/04/26 15:10:19,cookie="x",user=,vir

I tried to use regex, but without the expected result.

Objective is to have table with:

OS                  Nav
Windows NT 6.1      Chrome/49.0.2623.112
Linux               Chrome/49.0.2623.10

thanks for your help 🙂

[richgalloway · Accepted solution]

This worked for me using your sample data. You can check other strings at regex101.com

... | rex field=http_user_agent "\((?P<OS>[^;\*]+);.*\)\s(?P<Nav>[^ \*]+)" | ...

[fbertoletti]

Hello !

thank you, all seems to work.