I stumbled across the same thing today. Additionally i was wondering, if the regex itself has a mistake aswell. Our Firepower generates logs with the fields SrcIP and DestIP. However, the regexes only match a lowercase "p" at the end. Original Regex: EXTRACT-extract_src==^.+SrcIp\:\ (?P<src_ip>[^,;]+)
EXTRACT-extract_dest = =^.+DestIp\:\ (?P<dest_ip>[^,]+) Fixed Regex (not tested): EXTRACT-extract_src=^.+SrcIP\:\ (?P<src_ip>[^,;]+)
EXTRACT-extract_dest = ^.+DestIP\:\ (?P<dest_ip>[^,]+)
... View more