Incorrect Imail Events

[jknowles]

I am trying to have my Imail Logs indexed correctly. Right now there is no order to the events. They should be separated by Connection ID

Examples:

SMTP-(b200000069dbca52)

SMTP-(2edb0000685cc69c)

SMTPD(2edb0000685cc69c)

SMTPD(0000000000000000)

I have tried the Field Extraction Generator but it hasnot been able to correctly identfify the connection ID.

[jedinerd]

try piping your query to | rex field=_raw "SMTP[-D]((?[a-f0-9]*))"
That should extract the connection id to its own field. If that works i would suggest using that regex as a field extraction in props.conf.

Hope that helps!