ALERT! The community will be read-only starting on April 19, 8am Pacific as the migration begins. Read more for important details.
ALERT! The community will be read-only starting on April 19, 8am Pacific as the migration begins.Read more for important details.
Cadet 3rd Class Cadet 3rd Class
Cadet 3rd Class
317 views

Need regex for the Raw log to parse.

Hello Team,

Could you anyone provide the regex for the below raw log .

<158>Dec 08 16:30:25 AccessLogsArcsight_Push: Info: 1512750624.496 57 10.0.0.0 TCP_MISS/200 45008 GET http://static.dailyforest.com/wp-content/themes/wt_tera/css/font-awesome/fonts/fontawesome-webfont.woff?v=4.0.3 "RINET\cskk@NAADRealm" DIRECT/static.dailyforest.com application/octet-stream MONITOR_AMP_RESP_12-BypassAccessPolicy-All_AD_Users_AUTH-NONE-NONE-NONE-DefaultGroup <IW_scty,-3.0,0,"-",0,0,0,1,"-",-,-,-,"-",0,0,"-","-",-,-,IW_scty,-,"AMP High Risk","-","Unknown","Unknown","-","-",6316.91,0,-,"Unknown","-",37,"W32.Auto:0fd28fece9.in05.Talos",0,0,"fontawesome-webfont.woff","0fd28fece9ebd606b8b071460ebd3fc2ed7bc7a66ef91c8834f11dfacab4a849",3,-,"-">

 

thanks.

0 Likes
2 Replies
Fleet Admiral Fleet Admiral
Fleet Admiral

That looks like an IronPort Proxy log or Squid log. Have you tried one of those connectors to see if it will parse?
0 Likes
Cadet 3rd Class Cadet 3rd Class
Cadet 3rd Class

Hi Shaun,

This is Ironport log checked with parser and not able to ,thatys looking for regex.

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.