Rex fields from a log fle

[rczone]

I have the log snippet below want to extract id and hostname into 2 different fields

for example in the expected output from below is

id               host
rmk123     [email protected]
rmc143     [email protected]

[01/05/2020 13:06:21] BAUAJM_I_30031 Client [CA WAAE Auto:15515][5][[email protected]:50019:12.304.593.10] [0x80c91100][02/05/2020 13:06:21.8474][0:rmk123@[email protected] 0] API ID [34] execution started.

[01/05/2020 13:06:21] BAUAJM_I_30032 Client [CA WAAE Auto:15509][5][[email protected]:12345:19.304.293.10] [0x28bbbfff][02/05/2020 13:06:21.6946][0:rmc143@[email protected] 0] API ID [66] execution completed. Total time: 0.132519 seconds.

Please assist

[vnravikumar]

Hi @rczone

Try this

| makeresults 
| eval temp="[01/05/2020 13:06:21] BAUAJM_I_30031 Client [CA WAAE Auto:15515][5][[email protected]:50019:12.304.593.10] [0x80c91100][02/05/2020 13:06:21.8474][0:[email protected]@hostname.com 0] API ID [34] execution started.,,

[01/05/2020 13:06:21] BAUAJM_I_30032 Client [CA WAAE Auto:15509][5][[email protected]:12345:19.304.293.10] [0x28bbbfff][02/05/2020 13:06:21.6946][0:[email protected]@hostname.com 0] API ID [66] execution completed. Total time: 0.132519 seconds." 
| makemv delim=",," temp 
| mvexpand temp 
| rex field=temp "\[\S:(?P<id>[^\@]+)@(?P<host>[^\]]\S+)" 
| table id, host

[manjunathmeti]

You can use below regex:

| rex field=<FIELD_NAME> "\[0:(?<id>[a-z0-9]+)@(?<name>[a-z@.]+) 0\]" 

Test query:

| makeresults | eval test="[01/05/2020 13:06:21] BAUAJM_I_30031 Client [CA WAAE Auto:15515][5][[email protected]:50019:12.304.593.10] [0x80c91100][02/05/2020 13:06:21.8474][0:[email protected]@hostname.com 0] API ID [34] execution started.&[01/05/2020 13:06:21] BAUAJM_I_30032 Client [CA WAAE Auto:15509][5][[email protected]:12345:19.304.293.10] [0x28bbbfff][02/05/2020 13:06:21.6946][0:[email protected]@hostname.com 0] API ID [66] execution completed. Total time: 0.132519 seconds." | makemv delim="&" test  | mvexpand test | rex field=test "\[0:(?<id>[a-z0-9]+)@(?<name>[a-z@.]+) 0\]" | table id, name, test

[somesoni2]

Assuming those values always located in the same relative position( 7th value from starting which are enclosed between square brackets), give this a try

your base search 
| rex "^\[([^\[]+\[){6}[^:]+:(?<id>[^\@]+)@(?<host>\S+)"

Regex101 example of the regex: https://regex101.com/r/1gPnL8/1