extract subject from maillog

[dictudatacom]

Hi, I want to extract the 'subjects' from my SMTP maillog but the regex I have built doesn't seem to work. I have built the same type of regex to extract the FROM en TO fields and that works so I'm puzzled why it doesn't extract the subjects...

Regex looks like this:

(?i) subject <(?P[^>]*)

Can anyone help me out ? Thanks in advance!

[suepfarrell]

Thx jstockamp - that didn't quite work. I will give more detail in my own question I think. About to go set one up now.
Thanks

[jstockamp]

Your regex should looking something like this.

Subject.'(?.*)'

[suepfarrell]

Hi

Did you get an answer for this - trying to do this myself. My email subjects differ so I want to table them all

How did you end up extracting the subject lines?

Thanks
Sue

[dictudatacom]

Hi Ayn, here is a sample of the logfile, I want to extract the subject:

Mon Jul 2 10:20:38 2012 Info: Start MID 62771585 ICID 33896658
Mon Jul 2 10:20:38 2012 Info: MID 62771585 ICID 33896658 From: <*****>
Mon Jul 2 10:20:38 2012 Info: Delivery start DCID 24405838 MID 62771584 to RID [0]
Mon Jul 2 10:20:38 2012 Info: MID 62771585 ICID 33896658 RID 0 To: <*>
Mon Jul 2 10:20:38 2012 Info: MID 62771585 Message-ID '2B2E0EB229A8F44AB8C55D5E296BCFC40C584F@SCOMP0934.wurnet.nl'
Mon Jul 2 10:20:38 2012 Info: MID 62771585 Subject 'FW: Postbus AgroFood vanaf vrijdag 17:00 VOL: opnieuw inzenden!!'
Mon Jul 2 10:20:38 2012 Info: MID 62771585 ready 19724 bytes from <****>
Mon Jul 2 10:20:38 2012 Info: MID 62771585 matched all recipients for per-recipient policy DEFAULT in the outbound table
Mon Jul 2 10:20:38 2012 Info: MID 62771585 interim AV verdict using Sophos CLEAN
Mon Jul 2 10:20:38 2012 Info: MID 62771585 antivirus negative

[jfraiberg]

have you tried using the "extract fields" dropdown from one of the events?

[Ayn]

Please include a log sample. Without it it's hard to build a regex that should match.