Is it possible to put a conditional statement in a field extraction?

[brent_weaver]

I have files I am ingesting that have variable formats. I want to pick those lines out that only have an IP address as the third value and extract that as srcIP. Is this possible to essentially put a conditional statement in so I don't get all the garbage from the "other" data in the logs?

[gokadroid · Accepted solution]

if the IP you are looking for is before %ASA then try this which will save that in srcIP field:

yourBasequery
| rex "(?<srcIP>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\s%ASA"
| user srcIP here

check the extraction here

[brent_weaver]

I was able to solve this by using field extractor in the webui. It gave me the ability to say a string is "required" which would filter for %ASA. I was then able to utilize it to build my regular expression and it worked very nicely

[brent_weaver]

We may see this:

Oct 31 13:48:30 10.251.44.137 %ASA-4-106023: Deny tcp src clc:10.40.2.13/59318 dst outside:46.6.11.38/3389 by access-group "clc_in" [0x0, 0x0]

Or

Oct 31 13:48:30 10.251.44.137 %ASA-4-733100: [ Scanning] drop rate-1 exceeded. Current burst rate is 2 per second, max configured rate is 10; Current average rate is 8 per second, max configured rate is 5; Cumulative total count is 5176

I guess one could say I want only the lines that have %ASA in them. How do I do that?

[lukejadamec]

I don't understand. both of these events have %ASA in them. Also, is your intention to drop the events you don't want completely (not indexed) or keep the events but not extract the src_ip field?

[somesoni2]

Which ip address value you want to pick? could you highlight?

[lukejadamec]

It should be possible. Can you post some example events?