Hello,
Here is a regex that I've tested and it works with your sample data.
outside:(?<scr_ip>((\d{1,3}.)){3}\d{1,3})/(?<scr_port>\d+[^\s])(?:[\s\w]+):(?<dest_ip>((\d{1,3}.)){3}\d{1,3})/(?<dest_port>\d+[^\s])
wildcard:
outside:(?<scr_ip>[^/:]+)/(?<scr_port>\d+[^\s])(?:[\s\w]+):(?<dest_ip>[^/:]+)/(?<dest_port>\d+[^\s])
Also I would consider adding this to Field extractions for that source type. which would look like this.
outside:(?P<scr_ip>((\d{1,3}.)){3}\d{1,3})/(?P<scr_port>\d+[^\s])(?:[\s\w]+):(?P<dest_ip>((\d{1,3}.)){3}\d{1,3})/(?P<dest_port>\d+[^\s])
wildcard:
outside:(?P<scr_ip>[^/:]+)/(?P<scr_port>\d+[^\s])(?:[\s\w]+):(?P<dest_ip>[^/:]+)/(?P<dest_port>\d+[^\s])
You could alternatively added this to your transform.conf and associated with the source within your props.conf.
I also suggest purchasing Regex tool like RegexBuddy it very handy.
Hope this helps or gets you started. If it does dont foget to accept or vote it up.
Updated and verified regex for your examples listed:
wildcard:
src\s+(?:[\w_-]+):(?<scr_ip>[^/:]+)/(?<scr_port>[^\s]+)\s+dst\s+(?:[\w_-]+):(?<dest_ip>[^/:]+)/(?<dest_port>[^\s]+)
Regex break down:
src\s+ - set begin of regex and match scr and white space
(?:[\w_-]+): -None capture group to match everything before colon(:) and after previous regex
(?<scr_ip>[^/:]+) - capture group that capture any data after colon(:) and before slash(/). Basiclly wild card with expections
-(?<scr_port>[^\s]+) - capture group that capture any data after slash(/) and with no white space.Basiclly wild card with expections
\s+dst\s+ - regex for white space and dst
(?:[\w_-]+) - None capture group for any data after dst and before colon (:)
(?<dest_ip>[^/:]+) - Capture group for any data not colon or slash. Basiclly wild card with expections
: - regex for slash (/)
(?<dest_port>[^\s]+) -Capture group for any data not whitespace.Basiclly wild card with expections
I can create a regex wild card capture as long as you specify upper and lower bounds of your string.
... View more
