Update MAC address field with leading zeros

[gsmith]

Hello && welcome

Perhaps is this what you looking for?

Regex extractor not working

This might be a general regex problem, but I’ve confirmed it works and captures the MAC address on regexr.com and PowerShell. Expression ^dhcpd[\d+]:\s\w+\s(?:from|to)\s(.+?)\s.+$ Test String dhcpd[89514]: DHCPDISCOVER from 12:e4:88:ac:cd:12 via em0 Graylog version is 4.0.8.