I am using the following rex command to extract an id number, which is in the following format: 1e4gd5g7-4fy6-fg567-3d46-3gth63f57h35. I am also using the rex command to extract email addresses. However, it seems to extract the wrong information, let me show you:
index=keycloak "MFA"
| regex _raw="MFA challenge failed"
| rex "(?i) is (?P<keycloak_id>[^\"]+)"
| rex "(?i) is (?P<email_address>.+?)\.\s+"
| table Account_ID, email_address, keycloak_id, _time
However, this is the output that I get:
Account_ID | email_address | keycloak_id | _time |
aaaaaaa | 'OTP is invalid' | 'OTP is invalid'. Keycloak session id is 1e4gd5g7-4fy6-fg567-3d46-3gth63f57h35 | 2022-11-07 09:56:17.00 |
I'm really struggling to properly extract the right information that I'm looking for.
Any help would be greatly appreciated
Hi @jhilton90,
please try this
| rex "account\s+(?<account>\w+)\s+with\s+email\s+(?<email>[^ ]+)"
that you can test at https://regex101.com/r/6zSc2W/1
Ciao.
Giuseppe
You have a flimsy anchor - for example, " is " occurs multiple times in your event. You need to provide more context to the anchor so the right place can be found in your events.
The keycloak_id and email_address are in the same field. Basically the field goes like this:
message: MFA challenge succeeded for account aaaaaa with email example@example.com. Keycloak session id is 44t4tegr-44fg-4444-4444-444444444444
Try something like this
index=keycloak "MFA"
| regex _raw="MFA challenge failed"
| rex "(?i) account (?P<Account_ID>\S+)\s"
| rex "(?i) session id is (?P<keycloak_id>\S+)"
| rex "(?i) email (?P<email_address>\S+)\.\s+"
| table Account_ID, email_address, keycloak_id, _time
The keycloak_id and email_address are in the same field. Basically the field goes like this:
message: MFA challenge succeeded for account aaaaaa with email example@example.com. Keycloak session id is 44t4tegr-44fg-4444-4444-444444444444
Hi @jhilton90,
please try this
| rex "account\s+(?<account>\w+)\s+with\s+email\s+(?<email>[^ ]+)"
that you can test at https://regex101.com/r/6zSc2W/1
Ciao.
Giuseppe
Let me give it a go! Great resource by the way, thank you