Extractor dont'works

Graylog Central (peer support)
1

Hi

Mrs,Mr

I need help with the extractor.
I had this message (see below)

pri=4 c=458963 m=48 msg="Connection Opened" app=325678 appName="General UDP" n=690471732 proto=udp/85697 sent=42 rule="874

I try to extract “appname=” everytime this software see this word
So I try with a regular expression but the exctrator don’t work and the new field don’t create him in the messages ID

Someone can help me ?
Thanks
This is my configuration of my extractor

image
image1339×421 7.03 KB

PS: I am French I hope which you understand my message and I am sorry in order to my fault spelling.

2

I think your regex in not OK. Try to always check ouput by clicking on button Try. Try this regex instead of yours:

appName=“(.*)”

You can also use some online regex testers e.g.:

3

Thanks Shoothub.

I have a other question.
I would have just the field “appName” and not the rest of my messages . You think it’s possible with a Regex because when I do a grok parttern it’s work but it’s very hard to cut the message with a field and like my message isnot a same when I use Split & Index isnot working too.

4

Try to use this:

appName=“([^”]+)"

5

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.