How to extract same fields from different logs?

[marco_massari11]

Hi all,

I need to extract some fields for authentication events from different log types, here below some example:

LOG1

: AddSenaoLog%Client-6:LINUX_device(00:00:00:00:00:00/1.1.1.1) joins WLAN(WIFI) from MY-WIFI-0000-INT(00:00:00:00:00:00)

LOG2
: AddSenaoLog%Client-6:(00:00:00:00:00:00) joins WLAN(WIFI-CITYLIFE) from MY-WIFI-0000-INT(00:00:00:00:00:00)

LOG3

%Client-6:LINUX_device(00:00:00:00:00:00/1.1.1.1) joins WLAN(WIFI-OSPITI) from MY-WIFI-0000-INT(00:00:00:00:00:00)

LOG4

%Client-6:(00:00:00:00:00:00) joins WLAN(WIFI-OSPITI) from MY-WIFI-0000-INT(00:00:00:00:00:00)

As you can see in some case (LOG2 and LOG4) in the first parenthesis I have only the MAC address, in other cases (LOG1 and LOG3) I have both the IP and the MAC address, so I need to extract this two information (or only the MAC if the IP is missig as for LOG2 and LOG4) when I have "joins" in the logs.

Thanks in advance!

[gcusello]

Hi @marco_massari11,

please try this:

| rex "\((?<mac_address>\w+:\w+:\w+:\w+:\w+:\w+)(\/(?<ip>\d+\.\d+\.\d+\.\d+))*"

that you can test at https://regex101.com/r/IbmgF7/1

Ciao.

Giuseppe

[marco_massari11]

Ciao Giuseppe,

The correct MAC address is the one in the first parenthesis and it should be extracted when present, so I'm not interested in the second one at the end of the log. Moreover, I would like to extract these fields only when I find "joins" within the log, because it means a login success, in this way I can put in the transform format action::success and reason::success for the Authentication Data Model.

Ciao

Marco

@gcusello

[gcusello · Accepted solution]

Hi @marco_massari11,

see the approach to adapt to your need:

<your_search>
| rex max_match=1 "\((?<mac_address>\w+:\w+:\w+:\w+:\w+:\w+)(\/(?<ip>\d+\.\d+\.\d+\.\d+))*"
| stats values(ip) AS ip count BY mac_address
| where count>1

using max_match you take only the first occurrence of the regex.

Ciao.

Giuseppe