Since you are talking Cisco ASA events, this seems to work quite well on the events that we collect: rex "(?P<protocol>\w+)\s+connection" In our data only 60 events out of 36,000,000 didn't match a protocol. The protocol wasn't always something caught correctly, however. Here is the breakdown of the value of protocol of the 36M events: TCP - 69% no - 11% ICMP - 10% UDP - 10% matching - .05% Everything else made up less than 200 events of the 36M. So if you eliminate no and matching from your results, you should get a pretty good result set: rex "(?P<protocol>\w+)\s+connection" | search protocol=* regex protocol!="(no|matching|closing|Dropped|deleting|allocate)" There's plenty of opportunity to make changes to this, but it is at least a start. ... View more