I was trying to create a table for pfsense firewall logs using rex command. But it is not creating a table, instead showing the raw logs.
host="pfsense-firewall" "filterlog:" | rex field=_raw "filterlog:\s[0-9],[0-9],,[0-9],(?[0-9A-Za-z]),(?[A-Za-z]),(?[A-Za-z]),(?[A-Za-z]),[0-9],[0-9A-Za-z\s],[0-9],[0-9],[0-9],[0-9],[0-9A-Za-z],(?[0-9]),(?[A-Za-z0-9]),[0-9],(?[A-Za-z0-9.:]),(?[A-Za-z0-9.:]),(?[0-9]),(?[0-9]*)"
Can anyone point the error in the above command?
@jawadak, can you try by this:
host="pfsense-firewall" "filterlog:" | rex field=_raw "filterlog:\s[0-9],[0-9],,[0-9],(?<field1>[0-9A-Za-z]),(?<field2>[A-Za-z]),(?<field3>[A-Za-z]),(?<field4>[A-Za-z]),[0-9],[0-9A-Za-z\s],[0-9],[0-9],[0-9],[0-9],[0-9A-Za-z],(?[0-9]),(?<field5>[A-Za-z0-9]),[0-9],(?<field6>[A-Za-z0-9.\:]),(?<field7>[A-Za-z0-9.\:]),(?<field8>[0-9]),(?<field9>[0-9]*)"| table field*
If that not work can you please share the exampleof one event to test.
Regards
@jawadak, can you try by this:
host="pfsense-firewall" "filterlog:" | rex field=_raw "filterlog:\s[0-9],[0-9],,[0-9],(?<field1>[0-9A-Za-z]),(?<field2>[A-Za-z]),(?<field3>[A-Za-z]),(?<field4>[A-Za-z]),[0-9],[0-9A-Za-z\s],[0-9],[0-9],[0-9],[0-9],[0-9A-Za-z],(?[0-9]),(?<field5>[A-Za-z0-9]),[0-9],(?<field6>[A-Za-z0-9.\:]),(?<field7>[A-Za-z0-9.\:]),(?<field8>[0-9]),(?<field9>[0-9]*)"| table field*
If that not work can you please share the exampleof one event to test.
Regards
Thanks, it worked
The rex command just extracts fields from raw data, doesn't show in tabular format. You should be able to see the fields (if extraction is correct) on the field sidebar on the left. You'd need to specify a table command explicitly, with the fields that you want, to view a tabular output.