I have the following log statement and I would like to retrieve the mac address which is a 12 digit string from it.
msgType=notifications notification={"device":"mac:Ab12Cd34nm67","cam":"{\"mac\":\"Ab:12:Cd:34:nm:67\",\"Number\":\"AAAAAAAAA\",.....}"}
I tried with
host=host* source="source.log" "msgType=notifications*" | rex "(?<mac:.{12})>"
I'm looking for the string mac:Ab12Cd34nm67 . How can change the regex to obtain the expected string?
... View more