Field Extraction

Data Fields (Optional) adds extra fields from the message body. Those fields are available in filter expressions and in format strings (exports, forwards, email, HTTP, programs).

The same section appears on each feature editor and on other objects that format or filter messages.

Example

Network equipment can log each command run in the configuration console:

%ASA-7-111009: User 'enable_15' executed cmd: show logging mess 106100

The goal is two extra fields: {USER} for the username and {CMD} for the command.

Regex for extracting fields

One regular expression can capture several fields. Each named group becomes a field: (?<FIELD_NAME>…​).

Example for the command-log line above:

User '(?<USER>[^']+)' executed cmd: (?<CMD>.+)

That yields {USER} = enable_15 and {CMD} = show logging mess 106100.

Fields

Each Field has a name and a format string (text plus other fields). A regular-expression modifier on {MESSAGE} can pull out a single value.

Same example with Fields:

Field Format

USER

{MESSAGE|r/User '([^'])'/}+

CMD

{MESSAGE|r/executed cmd: (.)/}+

A length limit before a regex or a filter comparison reduces how much of the body is scanned.

Example: {MESSAGE|32|r/%ASA-\d-(\d+)/}+ takes an identifier from the start of the line.

Use extracted fields in Send Emails subject and body templates, other feature exporters, and filter expressions.

Field Collections

A field collection is a stored set of regular expressions (one per keyword). Field Collections in Data Fields applies one of those expressions to the message and exposes the captures as ACCESS_NAME.FIELD_NAME.

Setting Description

Collection access name

Prefix used in field names: {ACCESS_NAME.FIELD_NAME}.

Field collection

The collection to apply.

Keyword selector

Format string that chooses which expression in the collection runs.

Example: {MSGID}.

Related Topics