Skip to content

Instantly share code, notes, and snippets.

@flysen

flysen/exchange2016.grok

Last active September 28, 2017 07:20
Show Gist options
  • Save flysen/ca58bf769c9bc8265e2a3ecf393e0797 to your computer and use it in GitHub Desktop.
Save flysen/ca58bf769c9bc8265e2a3ecf393e0797 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
exchange2016.grok
%{TIMESTAMP_ISO8601:logdate},(%{IPORHOST:client_ip})?,(%{IPORHOST:client_hostname})?,(%{IPORHOST:server_ip})?,(%{IPORHOST:server_hostname})?,("%{DATA:source_context}"|%{DATA:source_context}),(%{DATA:connector_id})?,(%{WORD:source})?,(%{WORD:event_id})?,(%{NUMBER:internal_message_id})?,<(%{DATA:message_id})?>,(%{UUID:network_message_id})?,(%{DATA:recipient_address})?,(%{DATA:recipient_status})?,(%{NUMBER:total_bytes})?,(%{NUMBER:recipient_count})?,(%{DATA:related_recipient_address})?,(%{DATA:reference})?,(%{DATA:message_subject})?,(%{DATA:sender_address})?,(%{DATA:return_path})?,(%{DATA:message_info})?,(%{WORD:directionality})?,(%{DATA:tenant_id})?,(%{IPORHOST:original_client_ip})?,(%{IPORHOST:original_server_ip})?,(%{GREEDYDATA:custom_data})?
Raw
gistfile1.txt
%{TIMESTAMP_ISO8601:logdate},(%{IPORHOST:client_ip})?,(%{IPORHOST:client_hostname})?,(%{IPORHOST:server_ip})?,(%{IPORHOST:server_hostname})?,("%{DATA:source_context}"|%{DATA:source_context})?,(%{DATA:connector_id})?,(%{WORD:source})?,(%{WORD:event_id})?,(%{NUMBER:internal_message_id})?,<?(%{DATA:message_id})?>?(%{SPACE})?,(%{UUID:network_message_id})?,(%{DATA:recipient_address})?,(%{DATA:recipient_status})?,(%{NUMBER:total_bytes})?,(%{NUMBER:recipient_count})?,(%{DATA:related_recipient_address})?,(%{DATA:reference})?,("%{DATA:message_subject}"|%{DATA:message_subject})?,(%{DATA:sender_address})?,(%{DATA:return_path})?,(%{DATA:message_info})?,(%{WORD:directionality})?,(%{DATA:tenant_id})?,(%{IPORHOST:original_client_ip})?,(%{IPORHOST:original_server_ip})?,(%{GREEDYDATA:custom_data})?
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment