☰

陷入使用正则表达式选择列的困境（在 wazuh 解码器中）

tag-icon • tag-icon regular-expression
陷入使用正则表达式选择列的困境（在 wazuh 解码器中）

我有这个日志，但我不知道如何选择几列。

04.07.2021 12:11:31.801 [25760] info  MainForm  -  Database(s) loaded: CA_2021,beforetest,FL_2,FL_Jan_2021,jhon,DC_City_Jan_2021,Statetest,Benchmark_2021

我使用过(\d\d\d\d) (\d+:\d+:\d+)并能够选择

2021 12:11:31

谁能帮忙选择一下

2021 12:11:31 [25760] info FL_Jan_2021 DC_City_Jan_2021 Benchmark_2021

https://documentation.wazuh.com/current/user-manual/ruleset/ruleset-xml-syntax/regex.html

答案1

您可以使用以下自定义解码器来提取所有字段：

<decoder name="log1">
  <prematch>^\d\d.\d\d.\d\d\d\d \d\d:\d\d:\d\d.\d\d\d [\d+]\s+\w+\s+\w+\s+- </prematch>
  <regex>^(\d\d.\d\d.\d\d\d\d \d\d:\d\d:\d\d.\d\d\d) [(\d+)]\s+(\w+)\s+(\w+)\s+-\s+(\.+):\s+(\S+),(\S+),(\S+),(\S+),(\S+),(\S+),(\S+),(\S+)</regex>
  <order>decoded.date,decoded.pid,decoded.type,decoded.source,decoded.action,field1,field2,field3,field4,field5,field6,field7,field8</order>
</decoder>

您提到的字段分别提取为decoded.date、decoded.pid、decoded.type、field4和。如果您不想提取其他字段，您可以删除标签上的括号以及标签中的名称。field6field8<regex><order>

wazuh-logtest配置此解码器后，通过实用程序运行日志的结果/var/ossec/etc/decoders/local_decoders.xml是：

**Phase 1: Completed pre-decoding.
    full event: '14.07.2021 12:11:31.801 [25760] info  MainForm  -  Database(s) loaded: CA_2021,beforetest,FL_2,FL_Jan_2021,jhon,DC_City_Jan_2021,Statetest,Benchmark_2021'

**Phase 2: Completed decoding.
    name: 'log1'
    decoded.action: ' Database(s) loaded'
    decoded.date: '14.07.2021 12:11:31.801'
    decoded.pid: '25760'
    decoded.source: 'MainForm'
    decoded.type: 'info'
    field1: 'CA_2021'
    field2: 'beforetest'
    field3: 'FL_2'
    field4: 'FL_Jan_2021'
    field5: 'jhon'
    field6: 'DC_City_Jan_2021'
    field7: 'Statetest'
    field8: 'Benchmark_2021'

相关内容