Hello,
I have this logs :
Apr 26 12:49:09 10.30.245.203 Apr 26 14:49:12 MachineOne info tmm1[11869]: Rule /User_Agent : src_ip=112.43.9.4,vip=110.12.8.8,http_method=GET,http_host=www.xxxx.it:443,http_uri=/files/visio.jpg,http_url=www.xxx.it:443/files/x/x/x/x/x.jpg,http_version=1.1,http_user_agent="Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.112 Safari/537.36",http_content_type=,http_referrer="https://x/",req_start_time=2016/04/26 14:49:12,cookie="_x",user=,virtual_server="/x x x",bytes_in=0,res_start_time=2016/04/26 14:49:12,node=x ,node_port=80,http_status=200,req_elapsed_time=5,bytes_out=13290
I would like to only extract this part `Windows NT 6.1` and `Chrome/49.0.2623.112` in the **http_user_agent** field.
I also have another log with the values`Linux` and `Chrome/49.0.2623.105`
Apr 26 13:10:16 10.30.245.203 Apr 26 15:10:19 x info tmm[11869]: Rule /User_Agent : src_ip=x,vip=x8,http_method=GET,http_host=x,http_uri=x,http_url=x,http_version=1.1,http_user_agent="Mozilla/5.0 (**Linux**; Android 4.4.2; LG-D213 Build/KOT49I.A1407976057) AppleWebKit/537.36 (KHTML, like Gecko) **Chrome/49.0.2623.105** Mobile Safari/537.36",http_content_type=,http_referrer="x",req_start_time=2016/04/26 15:10:19,cookie="x",user=,vir
I tried to use regex, but without the expected result.
Objective is to have table with:
OS Nav
Windows NT 6.1 Chrome/49.0.2623.112
Linux Chrome/49.0.2623.10
thanks for your help :)
↧