Hi,
I have this log line:
May 13 08:01:56 192.168.10.10 system_service: 192.168.10.10 05/13/2020:07:01:56 GMT : GUI CMD_EXECUTED : User test_user - Remote_ip 10.10.10.10 - Command "login login tenant_name=Owner,password=********,Secret=*****,challenge_response=*****,token=80410000cb49a9,client_port=-1,cert_verified=false,sessionid=********,session_timeout=0,permission=superuser" - Status "Done"
and I already have the Fields:
user: test_user
remote_ip: 10.10.10.10
command: "login login tenant_name=Owner,password=********,Secret=*****,challenge_response=*****,token=*****,client_port=-1,cert_verified=false,sessionid=********,session_timeout=0,permission=user"
status: "Done"
But I need to extract new fields from the existing field "command"
For now what I need is to create the field "event" with the fist word (Login and Logout)
Is there any way to Extract a field from an existing ? Or do I have to use the REX in Search?
I have this search, but the event field has no values
index=my_index (command=login* OR command=logout*)
| rex field=command "event:^(.*.Command)\s+\"(?P\w+)"
| table user,event, command,remote_ip, status, _time
| sort -_time
I've tested this regex expression and it return the value "login" from the log line above.
Any idea of what I'm doing wrong?
Regards,
... View more