Hi there,

I’m trying to parse the message below using a pattern parser to extract only the following fields: srcip, dstip, srcintf, dstintf, and policyname. The remaining text should be captured as the message.

When I configure the filter as shown in the attached screenshot, only a single record is returned, and the rest are not displayed. The same issue occurs when using the parser mapping wizard with “PatternParser.”

What would be the correct parser configuration to produce eight columns, including date and time?


date=2025-03-28 time=21:06:09 id=7656555606374875313 itime="2025-03-29 05:06:10" euid=3 epid=3 dsteuid=3 dstepid=101 logflag=1 logver=705863652 type="traffic" subtype="forward" level="notice" action="close" utmaction="allow" policyid=61 sessionid=12592590 srcip=X.X.X.X dstip=Y.Y.Y.Y tranip=N.N.N.N transip=M.M.M.1 srcport=64117 dstport=54843 tranport=2178 transport=54844 trandisp="snat+dnat" duration=2 proto=6 sentbyte=452 rcvdbyte=2477 sentpkt=11 rcvdpkt=11 logid=0000000013 service="RPC" app="DCL" appcat="NetSer" srcintfrole="undefined" dstintfrole="aaa" dstserver=0 appid=15896 apprisk="low" policytype="policy" eventtime=178268245964307030 countapp=1 poluuid="006c0690-ad45-515e1-02b2-284f1bc4d7a8" dstmac="AA:AA:AA:AA:AA:AA" masterdstmac="BB:BB:BB:BB:BB:BB" dstdevtype="Unknown" dstosname="Unknown" srccountry="Reserved" dstcountry="Reserved" srcintf="interface_a" dstintf="interface_b" applist="default" vpntype="no" policyname="policy1" hostname="hostname" saasinfo=0 apps=DCL dstcity="Reserved" srccity="Reserved" psrcport=64110 pdstport=1451 srcgeoid=1000000000 dstgeoid=1000000000 vd="23" utmref="BBAD457ByYgAAAcCMQWrAjEFq" dtime="2025-03-28 21:06:09" itime_t=17825550770 devname="DEVICE"
to parse message

Thank you.