# Regex's extractor doesn't going well

**URL:** <https://community.graylog.org/t/regexs-extractor-doesnt-going-well/27619>\
**Category:** Development\
**Tags:** regex-special-charac\
**Created:** [February 7, 2023, 11:18am UTC](https://community.graylog.org/t/regexs-extractor-doesnt-going-well/27619 "2023-02-07T11:18:57Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![nov4n-4r](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/nov4n-4r/32/14148_2.png) [@nov4n-4r](https://community.graylog.org/u/nov4n-4r)\
**Post date:** [February 7, 2023, 11:18am UTC](https://community.graylog.org/t/regexs-extractor-doesnt-going-well/27619/1 "2023-02-07T11:18:57Z")

</div>

Hey there I need ur help plssss :)), I’ve tried to make an extractor to extract my fortigate’s logs using regex. I want to grep value of `crlevel` field with any criteria, but in the preview it’s just `crlevel` with “high” value is noted (there’s 4 type of value, it’s “critical”, “high”, “medium”, “low”). So it’s all, I wish someone can help me solve this problem. There’s the pict included based on preview.  
extractor :  
  
{  
“title”: “FortiGate Severity”,  
“extractor\_type”: “regex”,  
“converters”: ,  
“order”: 0,  
“cursor\_strategy”: “copy”,  
“source\_field”: “message”,  
“target\_field”: “FGT\_Severity”,  
“extractor\_config”: {  
“regex\_value”: “crlevel=\"(\w+)\"”  
},  
“condition\_type”: “none”,  
“condition\_value”: “”  
}  
],  
“version”: “5.0.3”

 ![WhatsApp Image 2023-02-07 at 18.04.11](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/5/5872d81954d853e1ec744160ac7ffb7a143a1aea.jpeg)

---

<div class="post-metadata">

**Author:** ![dscryber](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/dscryber/32/14178_2.png) [@dscryber](https://community.graylog.org/u/dscryber)\
**Post date:** [February 7, 2023, 4:16pm UTC](https://community.graylog.org/t/regexs-extractor-doesnt-going-well/27619/2 "2023-02-07T16:16:00Z")

</div>

Have your tried this? This regex should extract the value of the “crlevel” field: `crlevel="(\w+)"` .

I hope this helps.

---

<div class="post-metadata">

**Author:** ![nov4n-4r](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/nov4n-4r/32/14148_2.png) [@nov4n-4r](https://community.graylog.org/u/nov4n-4r)\
**Post date:** [February 7, 2023, 4:41pm UTC](https://community.graylog.org/t/regexs-extractor-doesnt-going-well/27619/3 "2023-02-07T16:41:03Z")

</div>

Yes, I have. but it’s still the same, its just grep “high” value for `crlevel`, and the others considered as empty value which is actually have another value like “critical” and “medium”

---

<div class="post-metadata">

**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\
**Post date:** [February 7, 2023, 10:52pm UTC](https://community.graylog.org/t/regexs-extractor-doesnt-going-well/27619/4 "2023-02-07T22:52:37Z")

</div>

Hey,

I hve Fortigate Firewalls

Are you trying to Graph the “LEVEL” (i.e, “critical”, “high”, “medium”, “low”) on the Graph? If this is correct here is mine.

![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/7/7112d249f3fdb4a7e244f5e33b9b1b68b61936b5.png)

Here it is with a pie chart.

![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/4/4e728a1b32e8934a5219f55d354d0836888634fe.png)

 ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/c/c999fb3e3a051d07ef79fb82fe78f1614f94acdb.png)

Not sure what you did. Looks like your exetracting the **Level** Info into a field and displaying it, Is this correct?

Example, here part of the log file

> subtype=“local” level=“notice” vd=“The-Lab” eventtime=1675808723 srcip=10.10.10.10 srcport=138 srcintf=“8.8.8.8”

---

<div class="post-metadata">

**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\
**Post date:** [February 7, 2023, 10:59pm UTC](https://community.graylog.org/t/regexs-extractor-doesnt-going-well/27619/5 "2023-02-07T22:59:51Z")

</div>

Hey,

I barely seen this in the picture.  
What happens when you remove the command in the search bar? shown here

![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/8/8cf03b466b60f31f80c778bab2b93bc3ab849105.png)

The reason i ask is if the field is already create to extrac the LEVEL info then that all you need to create you widget.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [February 21, 2023, 11:00pm UTC](https://community.graylog.org/t/regexs-extractor-doesnt-going-well/27619/6 "2023-02-21T23:00:02Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.