Regular Expressions 101

Community Library

Community Library Entry

10

Regular ExpressionOpen Workspace

/
.+HappyMK\s?(?<action>\S+)\s(?<chain>\w+):\sin:(?<int_in>\S+)\sout:(?<int_out>\S+), src-mac\s(?<src_mac>\S+),\sproto\s(?<prot>\w+)(\s(?<flags>\S+),|,)\s(?<src_ip>\b(?:\d{1,3}\.){3}\d{1,3}\b):(?<src_port>\d+)->(?<dest_ip>\b(?:\d{1,3}\.){3}\d{1,3}\b):(?<dest_port>\d+),(\s(?<NAT>\w+)\s\((?<src_nat_localip>\b(?:\d{1,3}\.){3}\d{1,3}\b):(?<src_nat_local_port>\d+)->(?<src_nat_public_ip>\b(?:\d{1,3}\.){3}\d{1,3}\b):(?<src_nat_public_port>\d+)\)->(?<dest_nat_ip>\b(?:\d{1,3}\.){3}\d{1,3}\b):(?<dest_nat_port>\d+),)?(\sprio\s(?<prio>\d+->\d+),)?\slen\s(?<len>\d+)
/

Description
Created·2015-05-30 10:27
Type·Match
Flavor·PCRE (Legacy)

Regex used in Splunk to extract fields from Mikrotik FW. NOTES:

  • Mikrotik must be configured to use "BSD Syslog" format
  • FW rules must add, as log prefix, the action:
    • drop
    • accep
    • reject
    • etc...
Submitted by HappyIdeasMaker
Open Workspace