Rules (XIF)
[MODEL: dataset="apache_tomcat_raw", model="Network"]
filter _raw_log contains "GET" or _raw_log contains "HEAD" or _raw_log contains "POST" or _raw_log contains "DELETE" or _raw_log contains "CONNECT" or _raw_log contains "OPTIONS" or _raw_log contains "TRACE" or _raw_log contains "PATCH"
| alter Request_time = arrayindex(regextract(_raw_log , "\[(\d+\/\w+\/\d+\:\S+)") , 0)
| alter Username = arrayindex(regextract(_raw_log,"(\S+)\s\[\d+\/") ,0)
| alter requested_line= arrayindex(regextract(_raw_log ,"\"(\w+\s[^\"]+)\"") ,0)
| alter response_code = arrayindex(regextract(_raw_log ,"\"\s(\d+)\s\d+") ,0)
| alter User_agent = arrayindex(regextract(_raw_log ,"\"\s\"([^\"]+)") ,0)
| alter Referrer= arrayindex(regextract(_raw_log ,"(http[^\"]+)"),0)
| alter bytes_size=arrayindex(regextract(_raw_log ,"\d\s(\d+)"),0)
// extract source_ip
| alter sourceipv4= arrayindex(regextract(_raw_log , "(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\s)\-") ,0)
| alter sourceipv6 = arrayindex(regextract(_raw_log ,"(\w+\:\w+\:\w+\:\w+\:\w+\:\w+\:\w+\:\w+)") ,0)
| alter sourceip = coalesce(sourceipv4 ,sourceipv6)
// end extract source_ip
| alter XDM.Network.Source.user.username =username
| alter XDM.Network.http.url = requested_line
| alter XDM.Network.event_timestamp= parse_timestamp( "%d/%b/%Y:%k:%M:%S", request_time)
//| alter XDM.Network.http.response_code = response_code
//| alter XDM.Network.http.user_agent= User_agent
| alter XDM.Network.http.referrer =Referrer
| alter XDM.Network.Destination.bytes=to_number(bytes_size)
| alter XDM.Network.Source.ipv4 =sourceip;