Im a newb to Grok and regular expressions, so forgive my ignorance. Have a Cisco Firepower syslog message that I want to extract the value for EgressZone. In the message I have the string
EgressZone: HA-Guest-Outside-Zone, IngressZone:
So I want to extract the value HA-Guest-Outside-Zone and assign it to the field EgressZone. I create a Grok Pattern extractor that looks like this:
This extractor returns HA. Apparently the filter for WORD does not include hyphens. Most of my values for Egress zone include one to three hyphens. What would the correct filter be to include hyphens in a word. Or is their a way to create a grok pattern that will Extract all characters after EgressZone: up to the comma? Perhaps a Grok Pattern is not the correct choice for this extractor?