Stripping characters from a field and convert to lower case


(Vince Van De Coevering) #1

I am importing IIS logs from the SMTP relay service. I have successfully separated out all of the fields in logstash. One of the data fields needs to have excess characters trimmed and then converted to lower case for the report grouping to display correctly.

The field name is cs-uri-query and it contains data like this:
FROM:jstrong@domain.com+SIZE=1351
TO:distributioncenter-dallas@domain.com
+TO:progammers@domain.com
to:programmers@domain.com
+to:PROGRAMMERS@DOMAIN.COM
=fromnpr3@domain.com+SIZE=1202

I want to retrieve the email address and convert it to lower case.

I would appreciate some code to try or a link that describes the process.
TIA

Vince


(Vince Van De Coevering) #2

ARGH!

The GUI stripped out the "<" character which marks the start of the email address and the "<" character that marks the end....


(Vince Van De Coevering) #3

Ok, I have figured out how to parse the field with grok
grok {
match => { "CS-URI-Query" => "(?[+A-Z][:][<])%{EMAILADDRESS:themail}%{GREEDYDATA:DropMe2}"}
}

This gives me a field, the mail, with the embedded email address. Now on to the next issue....


(system) #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.