I have this log but I don't know how to select few columns.

04.07.2021 12:11:31.801 [25760] info  MainForm  -  Database(s) loaded: CA_2021,beforetest,FL_2,FL_Jan_2021,jhon,DC_City_Jan_2021,Statetest,Benchmark_2021

I used (\d\d\d\d) (\d+:\d+:\d+) and able to select

2021 12:11:31

Can anyone help on selecting

2021 12:11:31 [25760] info FL_Jan_2021 DC_City_Jan_2021 Benchmark_2021



You may use the following custom decoder to extract all fields:

<decoder name="log1">
  <prematch>^\d\d.\d\d.\d\d\d\d \d\d:\d\d:\d\d.\d\d\d [\d+]\s+\w+\s+\w+\s+- </prematch>
  <regex>^(\d\d.\d\d.\d\d\d\d \d\d:\d\d:\d\d.\d\d\d) [(\d+)]\s+(\w+)\s+(\w+)\s+-\s+(\.+):\s+(\S+),(\S+),(\S+),(\S+),(\S+),(\S+),(\S+),(\S+)</regex>

Where the fields you mention are extracted as decoded.date, decoded.pid, decoded.type, field4, field6 and field8 respectively. If you don't wish to extract the other fields you may remove their parenthesis on the <regex> tag and their names from the <order> tag.

The result of running your log through the wazuh-logtest utility after configuring this decoder in /var/ossec/etc/decoders/local_decoders.xml is:

**Phase 1: Completed pre-decoding.
    full event: '14.07.2021 12:11:31.801 [25760] info  MainForm  -  Database(s) loaded: CA_2021,beforetest,FL_2,FL_Jan_2021,jhon,DC_City_Jan_2021,Statetest,Benchmark_2021'

**Phase 2: Completed decoding.
    name: 'log1'
    decoded.action: ' Database(s) loaded'
    decoded.date: '14.07.2021 12:11:31.801'
    decoded.pid: '25760'
    decoded.source: 'MainForm'
    decoded.type: 'info'
    field1: 'CA_2021'
    field2: 'beforetest'
    field3: 'FL_2'
    field4: 'FL_Jan_2021'
    field5: 'jhon'
    field6: 'DC_City_Jan_2021'
    field7: 'Statetest'
    field8: 'Benchmark_2021'

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.