Extract string from field

Graylog Central (peer support)
1

hi, i use graylog to check http traffic from exchange. On exchange http log i have this field called UserAgent that contain value like this:

Microsoft Office/16.0 (Windows NT 6.1; Microsoft Outlook 16.0.4549; Pro)

How i can create a rule to spilt this message into two field like OS and program? And i can create a lookup table for Operating system like Windows NT 6.1 -> Windows 7?

thank you

Andrea

2

you could use a REGEX for that or use a GROK pattern as extractor or processing pipeline for that.

sure you can create a lookup table - that would be a csv list

3

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.