Feedback:

rex

Use the rex operator to create one or more new fields or rewrite one or more fields with values populated by parsing an existing field with a Perl compatible regular expression (PCRE) or sed pattern.

Syntax

Note: You must place the rex operator after all condition clauses, to minimize the number of records processed. See AQL Best Practices for more information.

|rex [mode=sed] field=<field> "<regex or sed <field>>"

mode-sed Specify this option to use a sed expression instead of PCRE.
field=<field>

Specify the event log field to be parsed. For example, the following specifies that the url field is parsed:

field=url

"<<regex or sed <field>>"

Specify the regex or sed expression. Use angle brackets to specify the part of the expression that is the extracted field. For example, the following specifies that a new field named hostname is extracted:

"https://(?<hostname>.*)/.*"

Usage

You can use the rex operator to extract new fields using a regular expression. In the examples, the new field hostname is extracted from the url field; the new field dst is extracted from the dest field.

Example

Example 1: Extract agent message and raw event from message field for Cisco sourcetype.

Copy 
|where sourcetype = 'cisco' AND action = 'create'
|rex field=message '.*?msg=(?<agent_msg>.*?)rawEvent=(?<rawEvent>.*?)$'
|fields action, event_time, category, sourcetype

Example 2: Extract hostname from URL field using PCRE pattern.

Copy 
|rex field=url "https://(?<hostname>.*)/.*"|where url is not null

Example 3: Extract destination hostname prefix from destination field.

Copy 
|rex field=dest "^(?<dst>.*?)[\.|$]" |where dst is not null |fields dest, dst

Example 4: Extracts the event time Unix timestamp from raw Fortinet log strings using a regex capture group, then converts it to a parsed datetime field.

Copy 
ocsf 
| where metadata.product.vendor_name contains 'Fortinet' and raw_data contains 'eventtime=' 
| fields raw_data 
| rex field=raw_data 'eventtime=(?&lt;unix_timestamp&gt;\\d+)' 
| calc parsed_time=strptime(unix_timestamp, '%s')