Need help on rex

[bzwick]

Hi there,

I have nagios events like these ones:

[1390906919] SERVICE ALERT: hostname;Interface 10;CRITICAL;SOFT;2;CRIT - vif1 MAC: xx:xx:xx:xx:xx:xx, 1.41GBit/s, in: 1.13MB/s(0.7%), in-errors: 0.23%(!!) >= 0.1, out: 10.38MB/s(6.2%)

To create daily statistics I need a regex on the hostname which has to contain words like "lin", "win", "esx", ...

I am kinda stuck on this one, so any help would be appreciated.

[hRun]

To match any hostname in this specific example

EXTRACT-hostname = (?i)^\[\d+\]\s[^:]+:\s(?P<hostname>[^;]+);  

is the entry you would want to make in your props.conf.

To make restrictions to the possible hostnames change the part in between < hostname> and the closing bracket, or post some more examples.

Hope this helps

[kristian_kolb]

Since this piece of information seems to be located in the beginning of the event, is should be fairly easy to extract it. For the sample event given above, the following would work;

... | rex "\S+\s+\S+\s+(?<hostname>\w+);"

This will extract the hostname from the event, regardless of contents of the string. Then you can do the sorting/filtering/statistics as part of the query.

If you need to categorize by OS, and if this information can be deduced from the hostname, you can set this up with eval functions such as case;

.... | eval category = case(match(hostname, "win"), "Windows", match(hostname,"lin"), "Linux",match(hostname,"esx"),"ESX",1=1,"Other")

then do your statistics reporting with the category field.

Hope this helps,

K