Regular expression Extracter

[panklit (raphael)]

Hello,

i’m trying to extract some value from my syslog message but i’m not the best friend of regular expressions.

My string looks like that:

20171128-150445 ?event=B:Connect&time=1511881485&date=20171128-150445&ref=30353f027b1d5a01dce40090333029b3&dir=out&src_if=GW1&dst_if=PRI1

And i would like to extract the values into a new field so i have a field with the title “event” and the content “B:Connect”, next one would be title “time” and content “1511881485”, … i think you get it

Hope someone can help me out.

Thanks and Regards,
Raphael

[jtkarvo]

hi,

I would do several extractors.
First: if you do not have any more question marks after the first ?, then a split extractor that saves the second value as field “logline”. If there are more question marks later on the line, then a regex extractor like

^[1]\?(>?(.))$

Then, a replace regex extractor for the logline field that replaces all occurrences of & with a space; add a converter that saves all key=value pairs as fields.

---

1. ^\? ↩︎