search

Kintyre / TA-postfix

Postfix Add-on for Splunk (Compliant with the Mail CIM model)
https://splunkbase.splunk.com/app/3347/
Apache License 2.0
11 stars 3 forks source link

Tweak required for EXTRACT-queue_id #8

Closed barrettnet closed 3 years ago

barrettnet commented 3 years ago

The regex in this line, which is in /default/props.conf, needs to be adjusted.

From:

EXTRACT-queue_id = postfix/\w+\[\d+\]:\s+(?<queue_id>[A-Fa-f0-9]{6,20}):

To (or something similar):

EXTRACT-queue_id = postfix/[\w\\/]+\[\d+\]:\s+(?<queue_id>[A-Fa-f0-9]{6,20}):

The existing regex doesn't pick up cases where the process has more than one backslash - such as postfix/submission/smtpd

lowell80 commented 3 years ago

This is super helpful feedback, thanks!

lowell80 commented 3 years ago

The regex has been updated in b03478bb47. Take a look at the v0.8.4 release and give it a try when you get a chance.

I made only 1 small change to the provided regex: I removed the \/ as there's no need to escape the forward slash in this context.

BTW, I updated your description above to use triple backticks around the literals, because without it GitHub's formatting gets confused by all the special characters in the regex. ;-)

Thanks for taking the time to provide detailed feedback! Please re-open if you run into any additional issues with this version. Have a great day!

lowell80 commented 3 years ago

Sorry, grab v0.8.5 (build issues with 0.8.4, no change in the app other than version)

Installable version available here: https://github.com/Kintyre/TA-postfix/releases/tag/v0.8.5