How to extract multiple values for multiple fields within a single event?

[rayaivy]

I have nessus data for Installed Windows Updates (PluginID 52001).
Here is a list of quick-fix engineering updates installed on the
remote system :

+ KB4091664
  - Description : Update
  - InstalledOn : 1/22/2019

+ KB4132216
  - Description : Update
  - InstalledOn : 6/28/2018

+ KB4465659
  - Description : Security Update
  - InstalledOn : 1/19/2019

+ KB4480977
  - Description : Update
  - InstalledOn : 1/22/2019

Note that for detailed information on installed QFE's such as InstalledBy, Caption,
and so on, please run the scan with 'Report Verbosity' set to 'verbose'.

or in raw

...\nHere is a list of quick-fix engineering updates installed on the\nremote system :\n\n+ KB4091664\n  - Description : Update\n  - InstalledOn : 1/22/2019\n\n+ KB4132216\n  - Description : Update\n  - InstalledOn : 6/28/2018\n\n+ KB4465659\n  - Description : Security Update\n  - InstalledOn : 1/19/2019\n\n+ KB4480977\n  - Description : Update\n  - InstalledOn : 1/22/2019\n\nNote that for detailed information on installed QFE's such as InstalledBy, Caption,\nand so on, please run the scan with 'Report Verbosity' set to 'verbose'.\n...

I tried using the field extractor to no avail.

Need HotFixID, HotFixDesc, HotFixInstalledOn

[alemarzu · Accepted solution]

Hi there @rayaivy

Try like this.
... | rex max_match=0 "(?<HotFixID>KB\d+)[^\-]+-\sDescription\s:\s(?<HotFixDesc>[^\-]+)-\sInstalledOn\s:\s(?<HotFixInstalledOn>[\d\/]+)"

[rayaivy]

index=nessus pluginID=52001
|  rex max_match=0 "(?<HFID>KB\d+)[^\-]+-\sDescription\s:\s(?<HFDesc>[^\-]+)-\sInstalledOn\s:\s(?<InDate>[\d\/]+)"
| eval allVals=mvzip(HFID,mvzip(HFDesc, InDate,"~"),"~")
| expand allVals
| rex field=allVals "(?<HotFixID>[^~]+)~(?<HotFixDesc>[^~]+)~(?<InstallDate>.*)"
| table dnsName, HotFixID, HotFixDesc, InstallDate