Is there a regex that can be used to match the uids in the logs?

Zeek
1

Thanks.

2

Is there a reason why you can’t use the field seperator and field name?

3

This should get you there Paul:

egrep -o ‘[0-9a-zA-Z]{18}’

James

4

This is probably really ghetto but bear with me…

I am prototyping something where I am parsing the results from an elasticsearch query. I know what format my data is in but I want to be able to add some functionality for those sources that may not be structured the same way; for example no field names or different field indexes.

I want the regex so that I can do a replace (add a link to the uid) so the user can quick query it.

5

:slight_smile: Thanks.

6

I don't think there is a requirement that UIDs are 18 characters long. I believe it depends on the number being represented underneath. Although, now with 96bit uids it is less likely to have shorter uids but I think it's still possible.

  .Seth