Hi,
I am trying to Process below logs. These logs look likes CSV logs. But I am not able to use CSV filter as in "NewSetting field", data is not properly formated for some logs("AUTHZ-POLICY:Policy name="Protected Resource Policy", id="ab3e7d7d-7cf0-47d8-aa48-c67796214fe4", description="Protected Authorization Policy for OAMAgent", owners="", resources="[1b2f1e2c-f148-4e8d-8467-1f4afa731d73, 6f61810d-3a7e-4388-be6c-ef3649f33609, e9116dcf-0dbe-4021-bf0c-3745d8946195, df1ad41f-d297-4c59-a85f-5fdcac3fa1c7, 27ac7048-0bf0-4b91-98a5-74ee66a13ced, 8b62aabf-2124-47c4-90d8-f1bec563be6b, 19ec8e5b-d191-4712-9236-5d0e14f353ae, af4d6acf-c23e-4185-aaca-34473eb0fdf6, 60eaaf63-fd37-4a1d-9ec0-7617032f5388, 47fa13af-11ae-4fcb-b4dc-1f153998869c, 868e9e17-eaae-4f5c-9094-471c15f17f3d, 5582fa66-1af6-4de1-b46a-7053d886b161, a860bfbd-562d-4df8-8789-2ea95dd063d6, c636d160-9ff6-46d1-b1c6-76a69031fc92, b0f135e4-7274-4468-8a56-42a6842cd179, 53c14db3-7f76-4390-8027-7e86511849df, 71bf82c0-9076-4484-a7d9-e9c77e17c91b, b5482f97-c69c-490e-a5dd-9c9e3ac8b2d7, cce935d2-df26-46e7-99dc-0c60e5ee14d5, bcf99c5c-4c5a-4e2a-8f0f-226761eb97af, 2cf4ab7a-8769-42de-bfaa-ee40f9ea52cb, ff8f52fc-c3b7-4b71-a89f-d5b918e1c918, 1faa5696-3ae0-493d-ab46-c5580d1807e0, 5ed3e579-c79e-401d-a795-f70faff8cc6b, 7dbfce5c-d169-4b39-94f0-68d5cd585b04, 039eab52-93a2-4593-a343-474acc7a9c1f, 82c62ddb-a60b-4538-8f56-fc71cf7e2ed5, e0f8c75b-1fd8-4cb3-9a4f-78b774655a0b, c2888873-774e-4228-9ed0-b59fe5ddcd04, bc8266ee-222a-4497-9f9e-983adddc56d4, 83934f39-1326-4521-b3b9-c7e8c303143b, 2157e2bf-4b95-40ec-bdd5-50c927b9657d, d43fa098-746b-4e28-a7ec-b8045b3ef136, 40c51bbd-1430-43fe-a437-5c589dd50775, ba49e542-890f-46e3-81a2-c4b104b53df6, 7db8bb67-7d67-4721-9479-9afa7be9ac26, 9a0bf68e-3680-48cf-8c7d-6aaf64ad87a9, 32c876b9-9301-4adb-8fb3-de072fd1b73d, 951d6728-35db-476c-8b85-ec0488ba5bd0, 26a9b003-7598-45a0-98d7-4df1f8c0ff8e, b15d4fa6-7f97-4f48-9025-b4bf22d48723, f94a6dc5-038a-4f96-8383-fa6781182031]",conditions="[TrueCondition]",rules="[Rule : effect ="ALLOW",combiner ="SimpleCombiner: combiner-mode = "ALL",conditions ="[TRUE]".".]",sessionElements="",successResponses="",failureResponses="",successRedirectURL="null",failureRedirectURL="null".useImpliedConstraints="false"" - "AUTHZ-POLICY:Policy name="Protected Resource Policy", id="ab3e7d7d-7cf0-47d8-aa48-c67796214fe4", description="Protected Authorization Policy for OAMAgent", owners="", resources="[f94a6dc5-038a-4f96-8383-fa6781182031, b15d4fa6-7f97-4f48-9025-b4bf22d48723, 26a9b003-7598-45a0-98d7-4df1f8c0ff8e, 951d6728-35db-476c-8b85-ec0488ba5bd0, 32c876b9-9301-4adb-8fb3-de072fd1b73d, 9a0bf68e-3680-48cf-8c7d-6aaf64ad87a9, 7db8bb67-7d67-4721-9479-9afa7be9ac26, ba49e542-890f-46e3-81a2-c4b104b53df6, 40c51bbd-1430-43fe-a437-5c589dd50775, d43fa098-746b-4e28-a7ec-b8045b3ef136, 2157e2bf-4b95-40ec-bdd5-50c927b9657d, 83934f39-1326-4521-b3b9-c7e8c303143b, bc8266ee-222a-4497-9f9e-983adddc56d4, c2888873-774e-4228-9ed0-b59fe5ddcd04, e0f8c75b-1fd8-4cb3-9a4f-78b774655a0b, 82c62ddb-a60b-4538-8f56-fc71cf7e2ed5, 039eab52-93a2-4593-a343-474acc7a9c1f, 7dbfce5c-d169-4b39-94f0-68d5cd585b04, 5ed3e579-c79e-401d-a795-f70faff8cc6b, 1faa5696-3ae0-493d-ab46-c5580d1807e0, ff8f52fc-c3b7-4b71-a89f-d5b918e1c918, 2cf4ab7a-8769-42de-bfaa-ee40f9ea52cb, bcf99c5c-4c5a-4e2a-8f0f-226761eb97af, cce935d2-df26-46e7-99dc-0c60e5ee14d5, b5482f97-c69c-490e-a5dd-9c9e3ac8b2d7, 71bf82c0-9076-4484-a7d9-e9c77e17c91b, 53c14db3-7f76-4390-8027-7e86511849df, b0f135e4-7274-4468-8a56-42a6842cd179, c636d160-9ff6-46d1-b1c6-76a69031fc92, a860bfbd-562d-4df8-8789-2ea95dd063d6, 5582fa66-1af6-4de1-b46a-7053d886b161, 868e9e17-eaae-4f5c-9094-471c15f17f3d, 47fa13af-11ae-4fcb-b4dc-1f153998869c, 60eaaf63-fd37-4a1d-9ec0-7617032f5388, af4d6acf-c23e-4185-aaca-34473eb0fdf6, 19ec8e5b-d191-4712-9236-5d0e14f353ae, 8b62aabf-2124-47c4-90d8-f1bec563be6b, 27ac7048-0bf0-4b91-98a5-74ee66a13ced, df1ad41f-d297-4c59-a85f-5fdcac3fa1c7, e9116dcf-0dbe-4021-bf0c-3745d8946195, 6f61810d-3a7e-4388-be6c-ef3649f33609]",conditions="[TrueCondition]",rules="[Rule : effect ="ALLOW",combiner ="SimpleCombiner: combiner-mode = "ALL",conditions ="[TRUE]".".]",sessionElements="",successResponses="",failureResponses="",successRedirectURL="null",failureRedirectURL="null".useImpliedConstraints="false""). IS THERE IS ANY WAY I CAN HANDLE THESE CONDITION IN CSV FILTER OR PLEASE SUGGEST SOME OTHER WAY OUT.
#Fields:Date Time Initiator EventType EventStatus MessageText AuditUser AdditionalInfo AdminRoleName AgentID AgentType ApplicationDomainName ApplicationName AuthenticationMethod AuthenticationPolicyID AuthenticationSchemeID AuthorizationPolicyID AuthorizationScheme ClientIPAddress ConstraintType ContextFields DataSourceName DataSourceType DomainName ECID EventCategory FailureCode GenericAttribute1 GenericAttribute2 GenericAttribute3 GenericAttribute4 GenericAttribute5 HomeInstance HostId HostIdentifierName HostNwaddr IdentityDomain Impersonator InstanceName NewAttributes NewSettings OldAttributes OldSettings PolicyAdminContext PolicyName PolicyObjectID PolicyType ProtectionLevel RID ReadOnly RemoteIP RequestID Resource ResourceHost ResourceHostName ResourceID ResourceOperations ResourceTemplateName ResourceType ResourceURI ResponseType Roles SSOSessionID SchemeName ServerName ServiceIdentifier ServiceOperation ServiceURI SessionCreationTime SessionExpirationTime SessionId SessionLastAccessTime SessionLastUpdateTime Target TargetComponentType TenantId ThreadId TransactionId UserDN UserID UserTenantId
#Remark Values: ComponentType="OAM" ReleaseVersion="11.1.1.9.0"
2018-04-21 10:17:50.967 - "ServerUpgradeSubsystemStart" true - - - - - - - "oam_admin(11.1.2.0.0)" - - - - - - - - - - "elhoam_domain" "0000MBbgzYJESOWFLzUKOA1Qqkww000004" "Server" - "Configuration Store" - - - - - "elhoam1-prod" - "192.168.4.145" - - - - - - - - - - - - "0" - - - - - - - - - - - - - - - "AdminServer" - - - - - - - - - - - "13" - - - -
2018-04-21 10:17:51.139 - "ServerUpgradeSubsystemEnd" true - - - - - - - "oam_admin(11.1.2.0.0)" - - - - - - - - - - "elhoam_domain" "0000MBbgzYJESOWFLzUKOA1Qqkww000004" "Server" - "Configuration Store" - - - - - "elhoam1-prod" - "192.168.4.145" - - - - - - - - - - - - "0" - - - - - - - - - - - - - - - "AdminServer" - - - - - - - - - - - "13" - - - -
2018-04-21 10:17:52.943 - "ServerUpgradeSubsystemStart" true - - - - - - - "oam_admin(11.1.2.0.0)" - - - - - - - - - - "elhoam_domain" "0000MBbgzYJESOWFLzUKOA1Qqkww000004" "Server" - "Configuration Store" - - - - - "elhoam1-prod" - "192.168.4.145" - - - - - - - - - - - - "0" - - - - - - - - - - - - - - - "AdminServer" - - - - - - - - - - - "13" - - - -
2018-04-21 10:19:04.496 "PolicyStoreBootstrapUser" "PolicyModification" true - - - - - - - "oam_admin(11.1.2.0.0)" - - - "ab3e7d7d-7cf0-47d8-aa48-c67796214fe4" - - - - - - "elhoam_domain" "0000MBbgzYJESOWFLzUKOA1Qqkww000004" "AdminConsole" - - - - - - - "elhoam1-prod" - "192.168.4.145" - - - "AUTHZ-POLICY:Policy name=\"Protected Resource Policy\", id=\"ab3e7d7d-7cf0-47d8-aa48-c67796214fe4\", description=\"Protected Authorization Policy for OAMAgent\", owners=\"[]\", resources=\"[1b2f1e2c-f148-4e8d-8467-1f4afa731d73, 6f61810d-3a7e-4388-be6c-ef3649f33609, e9116dcf-0dbe-4021-bf0c-3745d8946195, df1ad41f-d297-4c59-a85f-5fdcac3fa1c7, 27ac7048-0bf0-4b91-98a5-74ee66a13ced, 8b62aabf-2124-47c4-90d8-f1bec563be6b, 19ec8e5b-d191-4712-9236-5d0e14f353ae, af4d6acf-c23e-4185-aaca-34473eb0fdf6, 60eaaf63-fd37-4a1d-9ec0-7617032f5388, 47fa13af-11ae-4fcb-b4dc-1f153998869c, 868e9e17-eaae-4f5c-9094-471c15f17f3d, 5582fa66-1af6-4de1-b46a-7053d886b161, a860bfbd-562d-4df8-8789-2ea95dd063d6, c636d160-9ff6-46d1-b1c6-76a69031fc92, b0f135e4-7274-4468-8a56-42a6842cd179, 53c14db3-7f76-4390-8027-7e86511849df, 71bf82c0-9076-4484-a7d9-e9c77e17c91b, b5482f97-c69c-490e-a5dd-9c9e3ac8b2d7, cce935d2-df26-46e7-99dc-0c60e5ee14d5, bcf99c5c-4c5a-4e2a-8f0f-226761eb97af, 2cf4ab7a-8769-42de-bfaa-ee40f9ea52cb, ff8f52fc-c3b7-4b71-a89f-d5b918e1c918, 1faa5696-3ae0-493d-ab46-c5580d1807e0, 5ed3e579-c79e-401d-a795-f70faff8cc6b, 7dbfce5c-d169-4b39-94f0-68d5cd585b04, 039eab52-93a2-4593-a343-474acc7a9c1f, 82c62ddb-a60b-4538-8f56-fc71cf7e2ed5, e0f8c75b-1fd8-4cb3-9a4f-78b774655a0b, c2888873-774e-4228-9ed0-b59fe5ddcd04, bc8266ee-222a-4497-9f9e-983adddc56d4, 83934f39-1326-4521-b3b9-c7e8c303143b, 2157e2bf-4b95-40ec-bdd5-50c927b9657d, d43fa098-746b-4e28-a7ec-b8045b3ef136, 40c51bbd-1430-43fe-a437-5c589dd50775, ba49e542-890f-46e3-81a2-c4b104b53df6, 7db8bb67-7d67-4721-9479-9afa7be9ac26, 9a0bf68e-3680-48cf-8c7d-6aaf64ad87a9, 32c876b9-9301-4adb-8fb3-de072fd1b73d, 951d6728-35db-476c-8b85-ec0488ba5bd0, 26a9b003-7598-45a0-98d7-4df1f8c0ff8e, b15d4fa6-7f97-4f48-9025-b4bf22d48723, f94a6dc5-038a-4f96-8383-fa6781182031]\",conditions=\"[TrueCondition]\",rules=\"[Rule : effect =\"ALLOW\",combiner =\"SimpleCombiner: combiner-mode = \"ALL\",conditions =\"[TRUE]\".\".]\",sessionElements=\"[]\",successResponses=\"[]\",failureResponses=\"[]\",successRedirectURL=\"null\",failureRedirectURL=\"null\".useImpliedConstraints=\"false\"" - "AUTHZ-POLICY:Policy name=\"Protected Resource Policy\", id=\"ab3e7d7d-7cf0-47d8-aa48-c67796214fe4\", description=\"Protected Authorization Policy for OAMAgent\", owners=\"[]\", resources=\"[f94a6dc5-038a-4f96-8383-fa6781182031, b15d4fa6-7f97-4f48-9025-b4bf22d48723, 26a9b003-7598-45a0-98d7-4df1f8c0ff8e, 951d6728-35db-476c-8b85-ec0488ba5bd0, 32c876b9-9301-4adb-8fb3-de072fd1b73d, 9a0bf68e-3680-48cf-8c7d-6aaf64ad87a9, 7db8bb67-7d67-4721-9479-9afa7be9ac26, ba49e542-890f-46e3-81a2-c4b104b53df6, 40c51bbd-1430-43fe-a437-5c589dd50775, d43fa098-746b-4e28-a7ec-b8045b3ef136, 2157e2bf-4b95-40ec-bdd5-50c927b9657d, 83934f39-1326-4521-b3b9-c7e8c303143b, bc8266ee-222a-4497-9f9e-983adddc56d4, c2888873-774e-4228-9ed0-b59fe5ddcd04, e0f8c75b-1fd8-4cb3-9a4f-78b774655a0b, 82c62ddb-a60b-4538-8f56-fc71cf7e2ed5, 039eab52-93a2-4593-a343-474acc7a9c1f, 7dbfce5c-d169-4b39-94f0-68d5cd585b04, 5ed3e579-c79e-401d-a795-f70faff8cc6b, 1faa5696-3ae0-493d-ab46-c5580d1807e0, ff8f52fc-c3b7-4b71-a89f-d5b918e1c918, 2cf4ab7a-8769-42de-bfaa-ee40f9ea52cb, bcf99c5c-4c5a-4e2a-8f0f-226761eb97af, cce935d2-df26-46e7-99dc-0c60e5ee14d5, b5482f97-c69c-490e-a5dd-9c9e3ac8b2d7, 71bf82c0-9076-4484-a7d9-e9c77e17c91b, 53c14db3-7f76-4390-8027-7e86511849df, b0f135e4-7274-4468-8a56-42a6842cd179, c636d160-9ff6-46d1-b1c6-76a69031fc92, a860bfbd-562d-4df8-8789-2ea95dd063d6, 5582fa66-1af6-4de1-b46a-7053d886b161, 868e9e17-eaae-4f5c-9094-471c15f17f3d, 47fa13af-11ae-4fcb-b4dc-1f153998869c, 60eaaf63-fd37-4a1d-9ec0-7617032f5388, af4d6acf-c23e-4185-aaca-34473eb0fdf6, 19ec8e5b-d191-4712-9236-5d0e14f353ae, 8b62aabf-2124-47c4-90d8-f1bec563be6b, 27ac7048-0bf0-4b91-98a5-74ee66a13ced, df1ad41f-d297-4c59-a85f-5fdcac3fa1c7, e9116dcf-0dbe-4021-bf0c-3745d8946195, 6f61810d-3a7e-4388-be6c-ef3649f33609]\",conditions=\"[TrueCondition]\",rules=\"[Rule : effect =\"ALLOW\",combiner =\"SimpleCombiner: combiner-mode = \"ALL\",conditions =\"[TRUE]\".\".]\",sessionElements=\"[]\",successResponses=\"[]\",failureResponses=\"[]\",successRedirectURL=\"null\",failureRedirectURL=\"null\".useImpliedConstraints=\"false\"" - - "AUTHZ-POLICY:Protected Resource Policy" - - - "0" - - - - - - - - - - - - - - - "AdminServer" - - - - - - - - - - - "13" - - - -