Regex to break from specific word or character in a log line

[tharu85 (Tharaka)]

I want to split below log line

"APP-DETECT TeamViewer remote administration tool outbound connection attempt" [Impact: Potentially Vulnerable] From ABC

As like

name : APP-DETECT TeamViewer remote administration tool outbound connection attempt
impact : Potentially Vulnerable
other : From ABC

How can I create a grok or regex to break sentence as above scenario.

[guyboertje]

I presume LS 5.x or greater.

You can use the dissect filter for this, provided that:

1. The first section is always in double quotes.
2. The second section is always in square brackets.
3. The term "Impact" is always the same and in the same place (let me know if a different term is in that place and you want the field to be named that, dissect has a solution for that)

If so then read on.

filter {
  dissect {
    mapping => { "message" => '"%{name}" [Impact: %{impact}] %{other}' }
  }
}

If some lines are not like this then use an if block to only apply dissect conditionally.

filter {
  if [message] =~ "^\"APP-DETECT.+\[Impact:.+\]"
    dissect {
      mapping => { "message" => '"%{name}" [Impact: %{impact}] %{other}' }
    }
  }
}