How to extract field names from Arris_log? I need help extracting alert numbers from these different raw logs.

[avishek08]

I need help extracting alert numbers from these different raw logs. I have tried using Field extractor and not having any luck aggregating them into a list or count

1: Oct 26 11:14:51 192.168.69.50 pfsp: Host Detection alert #21780827, start 2017-10-26 16:14:45 GMT, duration 6, direction incoming,

2: Oct 26 11:13:56 192.168.69.50 pfsp: TMS mitigation 'Alert 21780825 Auto-Mitigation' started at 2017-10-26 16:13:55

If possible please help me find appropriate "rex" command so I can learn too 🙂

[alemarzu · Accepted solution]

@avishek08

Try this regex.

... | rex "(?:alert\s#|\'Alert\s)(?<my_numbers>\d+)(?:\,\s|\s)" | stats count by my_numbers

[avishek08]

Thank you so much 🙂

[alemarzu]

Glad it worked out. Cheers!