..here is another example:
---search command:
index=log-3155-prod* eventtype=fwdldap-all-prod-hosts sourcetype="ldap-infra:access" laas_appId="ldap-infra/prod/ldap_FWD_PROD" "SRCH base="
---result:
[29/Jun/2017:03:28:37 -0400] conn=16035519 op=32155 msgId=32156 - SRCH base="msfwid=1281620,ou=people,o=company" scope=0 filter="(objectclass=)" attrs=ALL
[29/Jun/2017:03:28:37 -0400] conn=16047221 op=54 msgId=55 - SRCH base="msfwid=785323,ou=people,o=company" scope=2 filter="(objectclass=msperson)" attrs="personaltitle givenname msmiddleinitial sn cn mail telephonenumber employeenumber uid msfwid businesscategory departmentnumber title building floor"
[29/Jun/2017:03:28:37 -0400] conn=16035519 op=32154 msgId=32155 - SRCH base="msfwid=1487082,ou=people,o=company" scope=0 filter="(objectclass=)" attrs=ALL
[29/Jun/2017:03:28:37 -0400] conn=16047221 op=53 msgId=54 - SRCH base="msfwid=1260584,ou=people,o=company" scope=2 filter="(objectclass=msperson)" attrs="personaltitle givenname msmiddleinitial sn cn mail telephonenumber employeenumber uid msfwid businesscategory departmentnumber title building floor"
[29/Jun/2017:03:28:37 -0400] conn=16047226 op=102 msgId=55603 - SRCH base="msfwid=1421236,ou=people,o=company" scope=2 filter="(objectclass=msperson)" attrs="personaltitle givenname msmiddleinitial sn cn mail telephonenumber employeenumber uid msfwid businesscategory departmentnumber title building floor"
----field extraction:
(?=[^a]*(?:attrs=|a.*attrs=))^(?:[^"\n]*"){5}(?P<"attrib_extraction">[^"]+)
"attrib_extraction" -needed to added in this way even if inserted as code example...so please ignore the " " here.
Thanks
... View more