Skip to content

Instantly share code, notes, and snippets.

@prestonmcgowan
Last active September 24, 2024 16:20
Show Gist options
  • Save prestonmcgowan/8541ddee740a02213f9d00fe7eab9801 to your computer and use it in GitHub Desktop.
Save prestonmcgowan/8541ddee740a02213f9d00fe7eab9801 to your computer and use it in GitHub Desktop.
SELECT
CONCAT (
REGEXP_EXTRACT(
'(<(?<priority>\\d+)>)\\d+: (?<host>([a-z0-9\\-]+)): ]: (?<date>([a-zA-Z]{3}\\s+\\d+\\s+\\d+:\\d+:\\d+)|([0-9T:Z\\-]+)): (?<message>.+)',
`rawMessage`, 1
),
REGEXP_EXTRACT(
'(<(?<priority>\\d+)>)\\d+: (?<host>([a-z0-9\\-]+)): ]: (?<date>([a-zA-Z]{3}\\s+\\d+\\s+\\d+:\\d+:\\d+)|([0-9T:Z\\-]+)): (?<message>.+)',
`rawMessage`, 5
),
' ',
REGEXP_EXTRACT(
'(<(?<priority>\\d+)>)\\d+: (?<host>([a-z0-9\\-]+)): ]: (?<date>([a-zA-Z]{3}\\s+\\d+\\s+\\d+:\\d+:\\d+)|([0-9T:Z\\-]+)): (?<message>.+)',
`rawMessage`, 3
),
' ',
REGEXP_EXTRACT(
'(<(?<priority>\\d+)>)\\d+: (?<host>([a-z0-9\\-]+)): ]: (?<date>([a-zA-Z]{3}\\s+\\d+\\s+\\d+:\\d+:\\d+)|([0-9T:Z\\-]+)): (?<message>.+)',
`rawMessage`, 8
)
)
FROM MEAMD_NET_INITIAL LIMIT 4;
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment