rex extraction of multiple fields from a record (multi-line)

[nocostk]

I'm trying to extract some Oracle audit log fields on the fly. I can't seem to get my regex to match.

Source:

Audit file /u01/app/oracle/admin/prodprt/adump/prodprt2_ora_8944_1.aud
Oracle Database 11g Enterprise Edition Release 11.2.0.2.0 - 64bit Production
With the Partitioning, Real Application Clusters, Automatic Storage Management, OLAP,
Data Mining and Real Application Testing options
ORACLE_HOME = /u01/app/oracle/product/11.2.0.2/prodprt
System name:    Linux
Node name:  prodprtdb02
Release:    2.6.18-164.el5
Version:    #1 SMP Thu Sep 3 04:15:13 EDT 2009
Machine:    x86_64
Instance name: prodprt2
Redo thread mounted by this instance: 2
Oracle process number: 107
Unix process pid: 8944, image: oracle@prodprtdb02 (TNS V1-V3)
Wed Mar 16 09:01:08 2011 -06:00
LENGTH : '155'
ACTION :[7] 'CONNECT'
DATABASE USER:[1] '/'
PRIVILEGE :[6] 'SYSDBA'
CLIENT USER:[6] 'oracle'
CLIENT TERMINAL:[0] ''
STATUS:[1] '0'
DBID:[10] '1941709108'

Search string:

rex field=_raw "DATABASE\s+USER:\[\d\]\s+'(?<db_user>.+)?' PRIVILEGE\s+:\[\d\]\s+'(?<db_privilege>.+)?'"

I'm not sure how to indicate that there are one or more lines between the two.

[Ayn · Accepted solution]

You need to use the modifier (?s) at the start in order to have the regex match newlines as whitespace. This should work:

rex field=_raw "(?s)DATABASE\s+USER:\[\d\]\s+'(?<db_user>.+?)'\s+PRIVILEGE\s+:\[\d\]\s+'(?<db_privilege>.+?)'"

[ma_anand1984]

@gkanapathy

Very good comment. Thank you for leaving such comments

[gkanapathy]

Also note that \s will match against newlines, so you can also do (irrespective of the (?s) option) [\s\S] to match any character including newlines. The (?s) option causes . to match newlines, which it typically does not do.

[nocostk]

That did it, thanks!