I am using graylogger to send the output of a series of ping commands, over to Graylog. I have a pipeline grab those messages (it’s easy since I can set the facility) and add fields (RTT min, max, average, stddev, hostname, and packet loss) this is all very straightforward so far.
My question comes in trying to populate those fields. I want to split (or maybe regex) out the data and just can’t get something to start working. Can someone point me in the right direction? (I had to munch up the domain names so they didn’t show up as links…I am a new user and can only have 2 links in my message:-) . )
The fields I want (based on this message) are:
PING google.c (188.8.131.52) 56(84) bytes of data.
64 bytes from sfo07s17-in-f14.1e100.n (184.108.40.206): icmp_seq=1 ttl=54 time=9.15 ms
64 bytes from sfo07s17-in-f14.1e100.n (220.127.116.11): icmp_seq=2 ttl=54 time=9.36 ms
64 bytes from sfo07s17-in-f14.1e100.n (18.104.22.168): icmp_seq=3 ttl=54 time=9.24 ms
64 bytes from sfo07s17-in-f14.1e100.n (22.214.171.124): icmp_seq=4 ttl=54 time=9.36 ms
— google.c ping statistics —
4 packets transmitted, 4 received, 0% packet loss, time 3004ms
rtt min/avg/max/mdev = 9.151/9.282/9.369/0.090 ms
Thank you for your help on this question!