Repeating pattern in rex

[stwong]

Hi all,

I'm trying to get the string after the 3rd colon in following log entry using

rex "^([^:]+:){3,3}(?P<uastring>.+)$"

mod=http request|cli=192.169.209.46/55465|srv=192.168.160.233/8983|subj=cli|app=MSIE 8 or newer|lang=Chinese|params=dishonest|raw_sig=1:Accept=[image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5],?Referer,Accept-Language=[zh-HK],User-Agent,Accept-Encoding=[gzip, deflate],Host,DNT=[1],Connection=[Keep-Alive],?Authorization:Accept-Charset,Keep-Alive:Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Geck

However, uastring returns string after the first colon. Would anyone please help?

Sorry for the newbie question. Thanks.

Regards

[stwong]

oops, colon in the timestamp counts:

[2014/05/07 16:18:46] mod=http request|cli=192.168.182.33/32959|srv=192.168.84.7/80|subj=cli|app=???|lang=English|params=none|raw_sig=1:Host,Connection=[keep-alive],?Cache-Control,Accept=[text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8],User-Agent,?Referer,Accept-Encoding=[gzip,deflate,sdch],Accept-Language=[en-US,en;q=0.8,zh-CN;q=0.6]:Accept-Charset,Keep-Alive:Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.131 Safari/537.36

It works after matching the leading timestamp field. Sorry for my carelessness. Thanks.

Rgds

[stwong]

Got it. Thanks a lot.

[martin_mueller]

Yeah, that's expected behaviour - despite being parsed at index time the time stamp remains part of the event.

[martin_mueller]

Running this:

| stats count | eval _raw = "mod=http request|cli=192.169.209.46/55465|srv=192.168.160.233/8983|subj=cli|app=MSIE 8 or newer|lang=Chinese|params=dishonest|raw_sig=1:Accept=[image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5],?Referer,Accept-Language=[zh-HK],User-Agent,Accept-Encoding=[gzip, deflate],Host,DNT=[1],Connection=[Keep-Alive],?Authorization:Accept-Charset,Keep-Alive:Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Geck" | rex "^([^:]+:){3,3}(?P<uastring>.+)$"

Gives me uastring="Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Geck" which seems ok.