Trying to extract a field in rsyslog using regex with no luck

Question

Here is the data:

DROP IN=eth0 OUT= MAC=00:00:64:34:65:f8:00:00:5c:6f:36:46:08:00 SRC=6.6.73.64 DST=45.45.89.250 LEN=40 TOS=0x00 PREC=0x20 TTL=235 ID=2329 PROTO=TCP

I'm trying to extract values from the variables such as IN, MAC, SRC, etc.

I successfully used in SED or various REGEX simulators:

(?<=\sIN=)(.*?)(?=\s)

But when attempting to use it in rsyslog template configuration it seems to fail because data stops being sent:

property(outname="IN" name="msg" regex.expression="(?<=\sIN=)(.*?)(?=\s)" regex.submatch="1" regex.type="ERE" format="jsonf" onEmpty="keep")

This appears to be a problem specific to rsyslog .

Answer 1

With ERE:

[^[:space:]=]+=([^[:space:]]+)

Regex demo

According to the comments, the full working command:

property(outname="IN" name="msg" regex.expression="IN=([^[:space:]]*)" regex.submatch="1" regex.type="ERE" format="jsonf" onEmpty="skip")