Log event x: This is the name of the group#2 target(s) [name3]
Log event y: This is the name of the group#1 target(s) [name1,name2]
just omitted other parts of log including time-stamp.
how to extract all the names to one field "members" to produce a table group , members
not able to extract the second field, i a not good in regular expressions and couldn't find a way..
Any help will be appreciated
Two steps: First, extract the stuff between the brackets. Second, do a repeated match on the parts separated by commas:
... | rex "\[(?<members>[^\]]+)\]" | rex field=members max_match=0 "(?<members>[^,]+)"
Don't forget about the simplicity of the mighty eval
command:
... | rex "\[(?<members>[^\]]+)\]" | eval members=split(members, ",")