Hi Team,
I have sample set of events coming from the same logs and here "x" denotes a digit mostly IP address in this case and my requirement is that to split the data in the existing field "Forwar...
See more...
Hi Team,
I have sample set of events coming from the same logs and here "x" denotes a digit mostly IP address in this case and my requirement is that to split the data in the existing field "Forwarder" which is mentioned as "v". So already we have a field extraction in place i.e. the name of field is "Forwarder". And the current output is as below from all the 5 sample events and for the 5th sample event we don't have the "vvv" value itself in the logs.
Sample Logs:
2021-02-12 06:23:17 xx.xxx.xxx.xx GET /test/v1/xyz/abc/domainsetting domainName=xx.xxx.xxx.xx 443 - xx.xxx.x.xxx function/xxx.x.x.x - xxx x x xx vv.vvv.vvv.vv
2021-02-12 06:23:26 xx.xxx.xxx.xx GET /Window-2020-def-yy-ab - 443 - xx.xxx.x.xxx Mozilla/5.0+(compatible;+MSIE+9.0;+Windows+NT+6.1;+Linuxx/5.0;+AppInfo) - xxx x x xxx vv.vv.v.v
2021-02-12 06:11:55 xx.xxx.xxx.xx POST /test/abc/api/Control/Match - 443 - xx.xxx.x.xxx Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/88.0.4324.150+Safari/537.36 https://abc.def-mm.com/abc/def/dashboard/DeliveryList/DeliveryDetail?deliveryId=xxxxx&deliverySource=Feed xxx x x xxx vvv.vv.vvv.vvv,+vv.vvv.v.vvv,+vv.vvv.vvv.vv
2021-02-12 01:14:47 xx.xxx.xxx.xx GET /test/Abcdefgh/login+button+with+xyz.jpg - 443 - xx.xxx.x.xxx Mozilla/5.0+(iPhone;+CPU+iPhone+OS+14_4+like+Mac+OS+X)+AppleWebKit/605.1.15+(KHTML,+like+Gecko)+Mobile/xxxxx - xxx x x x vvvv:vvvv:vvvv:vvvv:vvvv:vvvv:vvvv:vvvv,+vvv.vvv.vvv.vvv
2021-02-12 07:32:20 xx.xxx.xxx.xx GET / - 443 - xx.xxx.x.xx - - x xx x x -
Forwarder (field name)
vv.vvv.vvv.vv vv.vv.v.v vvv.vv.vvv.vvv,+vv.vvv.v.vvv,+vv.vvv.vvv.vv vvvv:vvvv:vvvv:vvvv:vvvv:vvvv:vvvv:vvvv,+vvv.vvv.vvv.vvv
So I want to split them up in the same field name "Forwarder" i.e. Consider the 3rd (vvv.vv.vvv.vvv,+vv.vvv.v.vvv,+vv.vvv.vvv.vv) & 4th output (vvvv:vvvv:vvvv:vvvv:vvvv:vvvv:vvvv:vvvv,+vvv.vvv.vvv.vvv) in which the "Forwarder" field has multiple IP's in the same field for the 3rd and 4th output so we want to extract in separate fields under "Forwarder" with each IP.
Eg: Forwarder (field name) 123.456.78.912,+45.675.3.123,+32.123.456.55
Output should be as below for Forwarder Field name as: 123.456.78.912 45.675.3.123 32.123.456.55
So kindly help me with the regex for the same.