I've seen how to match certain logs, and match every line. But i want to do something a little different (if possible??)
I want to parse a log (that has many different line formats, looking for a particular keyword and then forward the variable pairs from this line to elastic, dropping all the other lines.
the line (and only line) will contain
Feb 18 11:51:36 07[IKE] <ikev1 22400> assigning virtual IP xx.xx.xx.xx to peer 'yyyyyyyy'
i want this, i want parts date, ip and peer
not all lines in the log (charon) will be like this
is this possible?