Hi there,

I’m trying to parse the message below using a pattern parser to extract only the following fields: srcip, dstip, srcintf, dstintf, and policyname. The remaining text should be captured as the message.

When I configure the filter as shown in the attached screenshot, only a single record is returned, and the rest are not displayed. The same issue occurs when using the parser mapping wizard with “PatternParser.”

What would be the correct parser configuration to produce eight columns, including date and time?


date=2025-03-28 time=21:06:09 id=7656555606374875313 itime="2025-03-29 05:06:10" euid=3 epid=3 dsteuid=3 dstepid=101 logflag=1 logver=705863652 type="traffic" subtype="forward" level="notice" action="close" utmaction="allow" policyid=61 sessionid=12592590 srcip=X.X.X.X dstip=Y.Y.Y.Y tranip=N.N.N.N transip=M.M.M.1 srcport=64117 dstport=54843 tranport=2178 transport=54844 trandisp="snat+dnat" duration=2 proto=6 sentbyte=452 rcvdbyte=2477 sentpkt=11 rcvdpkt=11 logid=0000000013 service="RPC" app="DCL" appcat="NetSer" srcintfrole="undefined" dstintfrole="aaa" dstserver=0 appid=15896 apprisk="low" policytype="policy" eventtime=178268245964307030 countapp=1 poluuid="006c0690-ad45-515e1-02b2-284f1bc4d7a8" dstmac="AA:AA:AA:AA:AA:AA" masterdstmac="BB:BB:BB:BB:BB:BB" dstdevtype="Unknown" dstosname="Unknown" srccountry="Reserved" dstcountry="Reserved" srcintf="interface_a" dstintf="interface_b" applist="default" vpntype="no" policyname="policy1" hostname="hostname" saasinfo=0 apps=DCL dstcity="Reserved" srccity="Reserved" psrcport=64110 pdstport=1451 srcgeoid=1000000000 dstgeoid=1000000000 vd="23" utmref="BBAD457ByYgAAAcCMQWrAjEFq" dtime="2025-03-28 21:06:09" itime_t=17825550770 devname="DEVICE"
to parse message

Thank you.

Hi MG,

I am able to get a good parse using the Pattern Parser...


With the pattern...

%S itime="%d{yyyy-MM-dd %H:mm:ss}" %S srcip=%s{srcip} dstip=%s{dstip} %S srcintf="%S{srcintf}" dstintf="%S{dstintf}" %S%n

If you look at the pattern, what I am doing is skipping irrelevant elements with %S.  LogViewPlus expects log entries to have the same structure, so one gotcha with this pattern is that the elements need to be in the order specified.  If this is not the case with your log file, you should consider using a multi-pattern.  If the parameters are random, you will need to use a customer parser.

Hope that helps,

Toby