I am attempting to import a ws_ftp log, but I am having issues parsing the log data. I can either get it to have no fields extracted or I end up with hundreds of entries for each event as it does not appear to break properly.
Sample log data:
20170214-10:59:58 COM_API 00000001 0 1 test ftp Login 278AA2E9-04A9-4484-9EAC-DF1EACBDF372 20170214-11:01:39 COM_API 00000001 0 1 test ftp CreateUser 278AA2E9-04A9-4484-9EAC-DF1EACBDF372 20170214-11:01:39 COM_API 00000001 0 1 test ftp SetSysAdmin 278AA2E9-04A9-4484-9EAC-DF1EACBDF372
From some post I have created a props.conf file of:
[WS_FTP]
TIME_PREFIX = \
TIME_FORMAT = %Y\%m\%d-%H:%M:%S
SHOULD_LINEMERGE = false
LINE_BREAKER = \>\s*(?=\)
REPORT-xmlext = xml-extr
and a transforms.conf:
[xml-extr]
REGEX = <([^>]+)>([^<]*)<\/\1>
FORMAT = $1::$2
MV_ADD = true
REPEAT_MATCH = true
I need to have each entry listed with the associated data as opposed to what i am getting now where there is an event for: , 278AA2E9-04A9-4484-9EAC-DF1EACBDF372, etc.
It seems to be right there, but still something is not working. I have tried without the transforms and only that props.conf, but that too yields similar results, so any help in getting each "entry" properly extracted would be much appreciated.
↧