Hi,
I try to use grok and parse two type of log entry possibility.
The field is a hostname receive by Cisco Prime.
Possibility 1 : AP23132_01,80:e0:1d:e0:c2:10
Possibility 2 : 80:e0:1d:e0:c2:10:AP23132_01
AP23132_01 can also vary with that pattern name.
AP23174_02
TCDAYFA001
TCDMYFA005
TCDQYFA004
TEDFYFA003
TMDGYFA002
TEHBYFA001
TMDFYFA006
TTELYFA111
I build a regex with regex101 and the result is ^[A-Z|0-9]{7}.\d{2}
Now I use grok and try to extract mac address from that filed and add a field MACADDRESS and extract the APNAME with the regex.
grok {
match => { "thefield" => [ "%{MAC:MACADDRESS}", "(?<APNAME>^[A-Z|0-9]{7}.\d{2})" ] }
}
Mac address part work fine but the APNAME part is not working. Can you help me to find the right solution .
Thank you!!!