Truncate message to custom fields

Post a different question

4
responses

A.Ivanov

Hi, how can I truncate message to custom fields? For example:

I have:

message: 2016-09-26 12:58:54 ru1-t001-web01 INFO "\Processor(_Total)\% Processor Time"="50.762249"

I need:

message: 2016-09-26 12:58:54 ru1-t001-web01 INFO "\Processor(_Total)\% Processor Time"="50.762249"

processorTime: 50.762249

Is it possible? Thank you.

AskedSeptember 26, 2016 - 1:39pm

Answers (2)

A.Ivanov

Solved, after posting :)

Exec if $raw_event =~ /(.*Available Bytes"=")(.*)"/ \
   {\
   $memory = $2;\
   }

Other question - how i can set type of field?

AnsweredSeptember 26, 2016 - 1:57pm

Leave a comment

Comments (2)

b0ti (NXLog)
Leave a comment
Captured values from a regexp will be always strings. If you want that to be an integer instead you can do this:

$memory = integer($2);
September 26, 2016 - 2:11pm

A.Ivanov
Leave a comment
ty

September 26, 2016 - 2:24pm

b0ti

Assuming you are using the im_winperfcount module to gather performance metrics on Windows then you don't need to do anything since the data will be available in custom fields as well, i.e. for the above exampe there will be a field as follows:

Processor(_Total)\% Processor Time: 50.762249

You might want to rename this of course.

AnsweredSeptember 26, 2016 - 2:00pm

Leave a comment

You are here

Truncate message to custom fields

Answers (2)

Comments (2)