Regular expression Extracter

Graylog Central (peer support)
1

Hello,

i’m trying to extract some value from my syslog message but i’m not the best friend of regular expressions.

My string looks like that:

20171128-150445 ?event=B:Connect&time=1511881485&date=20171128-150445&ref=30353f027b1d5a01dce40090333029b3&dir=out&src_if=GW1&dst_if=PRI1

And i would like to extract the values into a new field so i have a field with the title “event” and the content “B:Connect”, next one would be title “time” and content “1511881485”, … i think you get it :slight_smile:

Hope someone can help me out.

Thanks and Regards,
Raphael

2

hi,

I would do several extractors.
First: if you do not have any more question marks after the first ?, then a split extractor that saves the second value as field “logline”. If there are more question marks later on the line, then a regex extractor like

[1]\?(>?(.))$

Then, a replace regex extractor for the logline field that replaces all occurrences of & with a space; add a converter that saves all key=value pairs as fields.

  1. ^\? ↩︎

3

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.