QRadar，解析日志

Question

I want to parse some application log, I did a lot of regex that works correctly with notepad++ and the website www.regex101.com . But when I apply them in QRadar they don't match nothing.

For example

12/2/2017 9:53:58,4040007,blablablbla,blablabla --- Abonnement Mobile N° : 0663016666 | balbalbal | 03/06/2006 11:11:22 --- Soldes,10.10.10.10

I did this regex (?<=---)\\s+[A-Za-z+ \\/\\w+0-9._%+-]+(?=(\\sN°|\\s\\sN°|\\sID)) to match Abonnement mobile it works correctly , but it doesn't match anything in QRadar .

Answer 1

QRadar does not accept all regex configurations. When you try parsing something you can use extract property field to check. Here is a regex that works fine in my system.

 \-\-\-\s(\w+\s\w+)\s

this regex will work if only "Abonnement Mobile" field is includes letters or digits. If you want to catch "Abonnement Mobile N°" you can use this regex and this will work whatever comes in this field.

 \-\-\-\s([^\:]+)\: