Why is my rex command extracting other text strings

[jhilton90]

I am using the following rex command to extract an id number, which is in the following format: 1e4gd5g7-4fy6-fg567-3d46-3gth63f57h35. I am also using the rex command to extract email addresses. However, it seems to extract the wrong information, let me show you:

index=keycloak "MFA"
| regex _raw="MFA challenge failed"
| rex "(?i) is (?P<keycloak_id>[^\"]+)"
| rex "(?i) is (?P<email_address>.+?)\.\s+"
| table Account_ID, email_address, keycloak_id, _time

However, this is the output that I get:

Account_ID	email_address	keycloak_id	_time
aaaaaaa	'OTP is invalid'	'OTP is invalid'. Keycloak session id is 1e4gd5g7-4fy6-fg567-3d46-3gth63f57h35	2022-11-07 09:56:17.00

I'm really struggling to properly extract the right information that I'm looking for.

Any help would be greatly appreciated

[ITWhisperer]

You have a flimsy anchor - for example, " is " occurs multiple times in your event. You need to provide more context to the anchor so the right place can be found in your events.

[jhilton90]

The keycloak_id and email_address are in the same field. Basically the field goes like this:

message: MFA challenge succeeded for account aaaaaa with email example@example.com. Keycloak session id is 44t4tegr-44fg-4444-4444-444444444444

[ITWhisperer]

Try something like this

index=keycloak "MFA"
| regex _raw="MFA challenge failed"
| rex "(?i) account (?P<Account_ID>\S+)\s"
| rex "(?i) session id is (?P<keycloak_id>\S+)"
| rex "(?i) email (?P<email_address>\S+)\.\s+"
| table Account_ID, email_address, keycloak_id, _time

[gcusello]

Hi @jhilton90,

could you share some sample of your data?

Ciao.

Giuseppe

[jhilton90]

The keycloak_id and email_address are in the same field. Basically the field goes like this:

message: MFA challenge succeeded for account aaaaaa with email example@example.com. Keycloak session id is 44t4tegr-44fg-4444-4444-444444444444

[gcusello · Accepted solution]

Hi @jhilton90,

please try this 

| rex "account\s+(?<account>\w+)\s+with\s+email\s+(?<email>[^ ]+)"

that you can test at https://regex101.com/r/6zSc2W/1

Ciao.

Giuseppe

[jhilton90]

Let me give it a go! Great resource by the way, thank you