How to extract a field from the text

[Hema_Nithya]

Dec 2 09:02:17 server1 sudo: ib12345 : TTY=pts/0 ; PWD=/home/ib12345 ; USER=root ; COMMAND=/bin/su -

I need to extract ib12345 from the above data .

[Hema_Nithya]

sudo: ib12345 

Value ib12345 will change not constant . It is upi . 

[gcusello]

Hi @Hema_Nithya ,

please try this:

! rex "sudo:\s+(?<field>[^ ]+)"

that you can test at https://regex101.com/r/uBkpRh/1

Ciao.

Giuseppe

[ITWhisperer]

Assuming your spacing in your example is consistent with your events, then this should work

| rex "sudo:\s(?<field>\S+)\s"

[ITWhisperer]

This string appears twice, which one do you want to extract - in order for rex to find the right string, you need to define the pattern of characters around (either before, after or both) - unless you always want ib12345, in which case, this should work

| rex "(?<field>ib12345)"