Extracting 2 PARTS of a log line into 1 field

Graylog Central (peer support)
1

So I have some vpn logs like :
openvpn[17451]: timmy-vpn/192.168.8.11:52533 MULTI_sva: pool returned IPv4=192.168.90.5, IPv6=(Not enabled)
openvpn[17452]: tammy-vpn/192.168.8.12:51667 MULTI_sva: pool returned IPv4=192.168.90.6, IPv6=(Not enabled)
openvpn[17453]: tommy-vpn/192.168.8.13:55875 MULTI_sva: pool returned IPv4=192.168.90.7, IPv6=(Not enabled)

I would like to generate a field populated with the username AND the IPv4. Like
“tommy-vpn 192.168.90.7”

I started down the Grok road, and got something like this to match:
^openvpn[[0-9]+]: %{USERNAME:ovpn_user}/%{IPV4}.*IPv4=%{IPV4:ovpn_ip_assigned},
It works on this Grok tester :
http://grokdebug.herokuapp.com/
image

I created the Grok in the place you create them in Graylog.

But in the interface to create an extractor, this Grok doesn’t seem to match anything.

And I’m starting to think the Grok thing might not be what I’m looking for.

Is there a way to grab arbitrary parts of a text log message an join them together to a field?

2

with the processing pipelines and GROK your idea can bekome true. But not with the extractors.

1 Like
3

Thanks a ton!
I started getting that feeling.

4

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.