I'm completely stuck here. I'm trying to extract the "Path" from a logfile with this format:
Time: 05/10/2022 11:26:53
Event: Traffic
IP Address: xxxxxxxxxx
Description: HOST PROCESS FOR WINDOWS SERVICES
Path: C:\Windows\System32\svchost.exe
Message: Blocked Incoming UDP - Source xxxxxxxxxx : (xxxx) Destination xxxxxxxxxx : (xxxxx)
Matched Rule: Block all traffic
using this regex
((Path:\s{1,2})(?<fwpath>.+))
It does exactly what I want when I use rex, it extracts the path as "fwpath". However, when I do it as a field extraction, it matches the rest of the log entry. Why is it behaving differently for these two?
Try this
((Path:\s{1,2})(?<fwpath>\S+))
That (almost) did it! I had to replace \S with \N so that it wouldn't stop at spaces in paths, like "C:\Program Files".
Thanks much!