Created on 03-11-2020 07:13 PM - last edited on 03-11-2020 09:35 PM by ask_bill_brooks
Below is the text and I need to write the regular expression so that I can extract attribute from this field.
2017-04-27 09:07:20.517342 10.69.1.138 -> 10.69.1.100 <4>Apr 27 03:37:13 kernel: [ 78.294310] TS|4294745280|00:14:5a:03:29:33|RSSI_BCN|34
timestamp:2017-04-27 09:07:20.517342
source_ip:10.69.1.138
dest_ip:10.69.1.100
mac:00:14:5a:03:29:33
obm:RSSI_BCN
dbm:34
How can I write the regex sothat I can collect each of the field from the text?
Created 03-12-2020 06:05 AM
I know some other people with big time Regex Skills can map it differently but the method I use it to get single values using strategic wildcard like searches in ReplaceText like:
timestamp : ([0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[1-2][0-9]|3[0-1]) (2[0-3]|[01][0-9]):([0-5][0-9]):([0-9]{2}).([0-9]{6})) .*
source_ip : .* (.*) -> .*
dest_ip : .* -> (.*) <.*
Mac : ^.*] TS\|[0-9]{10}\|([a-fA-F0-9:]{17}|[a-fA-F0-9]{12})\|.*$
dbm : ^.*\|(.*)$
I also test using a regex tester like this one: REGEX
Created on 03-12-2020 09:53 AM - edited 03-12-2020 09:56 AM
Hello Steve,
Thanks for your answer. Don't know why your provided answer is not working in my case. But I solved it in another way which I am sharing here for others
timestamp : ([0-9]{4})-([0-1][0-9])-([0-3][0-9])\s([0-1][0-9]|[2][0-3]):([0-5][0-9]):([0-5][0-9]).(\d*)
source_ip : (?:[0-9]{1,3}\.){3}[0-9]{1,3}
Mac : ([0-9A-Fa-f]{2}[:]){5}([0-9A-Fa-f]{2})
dbm : (\d*)\z
Thanks!
Created 03-12-2020 06:05 AM
I know some other people with big time Regex Skills can map it differently but the method I use it to get single values using strategic wildcard like searches in ReplaceText like:
timestamp : ([0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[1-2][0-9]|3[0-1]) (2[0-3]|[01][0-9]):([0-5][0-9]):([0-9]{2}).([0-9]{6})) .*
source_ip : .* (.*) -> .*
dest_ip : .* -> (.*) <.*
Mac : ^.*] TS\|[0-9]{10}\|([a-fA-F0-9:]{17}|[a-fA-F0-9]{12})\|.*$
dbm : ^.*\|(.*)$
I also test using a regex tester like this one: REGEX
Created on 03-12-2020 09:53 AM - edited 03-12-2020 09:56 AM
Hello Steve,
Thanks for your answer. Don't know why your provided answer is not working in my case. But I solved it in another way which I am sharing here for others
timestamp : ([0-9]{4})-([0-1][0-9])-([0-3][0-9])\s([0-1][0-9]|[2][0-3]):([0-5][0-9]):([0-5][0-9]).(\d*)
source_ip : (?:[0-9]{1,3}\.){3}[0-9]{1,3}
Mac : ([0-9A-Fa-f]{2}[:]){5}([0-9A-Fa-f]{2})
dbm : (\d*)\z
Thanks!