1
response

Issues developing Regex Patterns

Hi, I am trying to create a regex for parsing log lines from an application. The issue is that the regex works fine in other applications, regex makers, etc. But when used by NXLog it won't find any matches, so I'm afraid there may be some NXLog specific regex syntax. Before I deconstruct this large regex and restart my service repeatedly, I wanted to ask if there is anything immediately obvious that is wrong... or is there a way to create these patterns in a reliable way?

AskedOctober 26, 2021 - 6:15pm
3
responses

Regex to set variable

Hi,
I’m trying to use regex in nxlog.
My current configuration is to save firewall logs to a file .txt using the $Sender value to create the file name.

.......

<Input *****>
Module im_tcp
Host 0.0.0.0
Port 1001
<Exec>
if $raw_event =~ /LEEF/
parse_leef();
else
parse_syslog();
</Exec>
</Input>

.......

AskedSeptember 4, 2019 - 5:36pm
3
responses

Pattern DB appears to drop fields

I'm trying to get a PatternDB working correctly, and it looks like I'm getting some fields but not all of them. There's only one pattern that's actually generating extra fields, and even it is dropping the first field (ParsedDate). Not sure what's going on here...


Config file (via file inclusion):

<Extension json>
    Module      xm_json
</Extension>

AskedFebruary 10, 2017 - 6:06pm
1
response

Multiline Headerline Regex Error

I am trying to use the multlog module in order to start ingesting a custom log:

I have the following regex: \^(\d{2}|\d).(\d{2}|\d).(\d{4})\s(\d\d|\d):(\d\d|\d):(\d\d|\d)\s(AM|PM).\[(.*)\](.*) 

This works in a regex test; however I cannot get it to work with the log file that looks something like this

AskedSeptember 15, 2015 - 4:12pm
9
responses

how to get values extracted using regex?

Hello,

I'm quite new to nxlog, so forgive me if my question is  trivial but I'm having hard time to get the values I extract from my  logs using exec and a regex. I have a very large stash of old windows logs in text file (in multiline format), what I want to do is use nxlog to load them in graylog, but I want to format the log in a different way.

AskedAugust 31, 2015 - 4:17am

Pages