I am trying to use the rex command to extract an id number, which is a mixture of letters and numbers separated by a dash. For example, one of the ids looks like this:
34gv564-3333-5tg4-gt53-4rgt5eg5g35gb
The field itself is as follows: MFA challenge succeeded for account aaaaaaaaa with email example@example.co.uk. Session id is 34gv564-3333-5tg4-gt53-4rgt5eg5g35gb
The rex command I'm using is as follows:
| rex "(?i) is (?<id_number>[^\"]+)"
The only problem is that sometimes it extracts the email address bit too
Any help would be greatly appreciated
To avoid extracting data from the wrong place, the regex should be more specific.
| rex "Session id is (?<id_number>[^\"]+)"
Since we only have a partial event to work with (the regex implies something in quotes follows, but it's not in the example event), it's impossible to know if there is a better way to extract the field.
try this
| rex ^(?<id_number>.+)
That just extracts the entire event unfortunately
Thanks anyway though