Hello, i searched few hours how to extract the RULE_NAME field from my Firewall logs without success. RULE_NAME is at the end of the log line, between (). It can contain any characters, space, "-" or "_". My problem comes from the fact that the RULE_NAME is sometimes finished by a 3 characters string i need to remove : "-00"   Here is my actual REGEX, but it does't works for the simple "Internal Policy" RULE_NAME :  .*\s+\((?P<RULE_NAME>.*)?(-00)\)$   Here are original logs lines i need to match : May 3 16:35:02 10.40.1.254 May 3 16:35:02 MYFIREWALL.mycorp.lan firewall: msg_id="3000-0148" Allow 0-SSL-VPN Firebox 73 udp 20 128 172.XXX.XXX.14 172.XXX.XXX.1 54127 53 src_user="fgi@mycorp.com" (DNS-01-proxy_user.out-00) May 3 17:39:56 10.40.1.254 May 3 17:39:56 MYFIREWALL.mycorp.lan firewall: msg_id="3000-0148" Allow VLAN1-Lan-Trusted Firebox 69 udp 20 128 172.21.20.26 172.21.20.254 52481 53 msg="DNS Forwarding" src_user="yal@mycorp.lan" record_type="A" question="sync.srv.stackadapt.com" (Internal Policy) May 3 16:35:02 10.40.1.254 May 3 16:35:02 MYFIREWALL.mycorp.lan firewall: msg_id="3000-0148" Allow 0-SSL-VPN Firebox 73 udp 20 128 172.XXX.XXX.14 172.XXX.XXX.1 54127 53 src_user="fgi@mycorp.com" (My super rule name with space DNS.out) Any idea on how to ignore the "-00" suffix when present ? thanks Florent   ... View more

Hello, i' trying (without success...) to use a custom search to get the list of possible values of a field in a drill down input field of a Dashboard i'm working on. Here is the search i use to look at "exotic" Firewall logs and extract the possible RULE_NAME field values : index=my_index | rex field=_raw ".*\s(?<HOSTNAME>\S+)\s(?<PROCESS>\S+):\s.*\s(?<ACTION>(Allow|Deny))\s(?<SRC_INT>\S+)\s(?<DST_INT>\S+)\s.*(?<PR>(icmp|tcp|udp)).*\s(?<SRC_IP>[[octet]](?:\.[[octet]]){3})\s(?<DST_IP>[[octet]](?:\.[[octet]]){3})\s(?<SRC_PORT>\d{1,5})\s(?<DST_PORT>\d{1,5})\s.*\((?P<RULE_NAME>.*)?(-00)\)$" | stats values(RULE_NAME) | sort -n   => it is displaying with success what i need if i run it into a simple searh window.   here is what i put in my fields of the Dropdown menu : Input Type : Drop down Label  : Rule Name Token : rule_name_token Created a STATIC OPTION named ANY with "*" as value (also set as default one) Field For Label : RULE_NAME Field For Value : RULE_NAME   Problem : Nothing appears but ANY in my dropdown list (even if a can see briefly the "populating..." keywork displayed under this input dropdown menu during 1 second). Any help please ? i certainly missed something ? Thanks Florent   ... View more