So I attempted to use some of the firepower extractors from marketplace, and they seem incomplete or non-functional for my 6.2.2 Firepower components, so I decided to create/edit them myself. I think I understand the pattern matching regex pretty well. The problem is it just doesn’t seem to be matching the optional group at the end of the string. Here is an example of when the "URL: " field is present:
(examples removed due to new user url restrictions)
I think ideally I’d like to use just a generic key/value extraction function that matches these delimiters (I see a lot of examples for the kv plugin for logstash, but can’t seem to find examples for graylog), since the connection event table for Firepower seems to have a lot of optional fields. An example of this would be mucho appreciated. I believe this would be done with set_fields(key_value())??
PS
If I posted wrong or in the wrong place, I apologize.
