Hi Phillipp ! Thanks for reply.
I followed this step:
take a look at the CSV To Fields converter.
Steps:
- Go to the Extractor page of your Input, click Get Started.
- Create an Copy Input extractor on your message field, that copies to itself.
- At the bottom add and configure a CSV To Fields converter.
But i get only the same message. I cant extract anything.
I cant found how extract a message like this, neither Rexgex or Grok because it not have labels
"<134>Mar 7 18:57:53 filterlog: 79,16777216,1469649672,em0,match,pass,out,4,0x0,62,13847,0,DF,6,tcp,60,1.1.1.1,2.2.2.2,"
If were like this (filterlog:79 with label case):
"<134>Mar 7 18:57:53 filterlog: 79,**a:**16777216,**c:**1469649672,**d:**em0,**e:**match,**f:**pass,**g:**out,**h:**4,**i:**0x0,62,13847,0,DF,6,tcp,60,**r:**1.1.1.1,**s:**2.2.2.2,"
regex_value: s:?([0-9.]+) result= 2.2.2.2
I think, that i have to do something to count between comas.
Please, tell me if i’m not clear, or maybe i missing something.
Thanks!