Rules (XIF)
[MODEL: dataset = msft_ecm_raw]
alter
thread_id = arrayindex(regextract(_raw_log, "thread\=\"*(\d+)\"*"), 0),
file = arrayindex(regextract(_raw_log, "file\=\"([^\"]*)\""), 0),
msg_1 = arrayindex(regextract(_raw_log, "^(.+)[\~|\$]"), 0),
msg_2 = arrayindex(regextract(_raw_log, "^\<\!\[LOG\[(.+)\]LOG"), 0),
component = arrayindex(regextract(_raw_log, "component\=\"(\S+)\""), 0),
component2 = arrayindex(regextract(_raw_log, "\<(SMS\S+)\>"), 0),
ipV4 = arrayindex(regextract(_raw_log, "\b(?:\d{1,3}\.){3}\d{1,3}\b"), 0),
filename = arrayindex(regextract(_raw_log ,"Processing\sfile\s(\S+)\s"),0),
path = arrayindex(regextract(_raw_log ,"path\s*[\:|\=]\s*\'([^\']+)\'"),0),
dns_name = arrayindex(regextract(_raw_log ,"DNS\sname\s\=\s\'([^\']+)\'"),0),
site_server = arrayindex(regextract(_raw_log , "SiteServer\=([^\,]+)\,"),0),
duration1 = arrayindex(regextract(_raw_log ,"\s(\d*\.*\d+)\sseconds"),0),
duration2 = arrayindex(regextract(_raw_log ,"\s(\d*\.*\d+)\shours"),0),
duration3 = arrayindex(regextract(_raw_log ,"\s(\d+)\sminutes"),0),
log_prefix = lowercase(arrayindex(regextract(_raw_log ,"^([A-Za-z]*\s*[a-zA-Z]*)\>*\:"),0)),
event_type = arrayindex(regextract(_log_source_file_name, "([\w_]+)[-\d+]{0,}\.log"),0),
user_name_1 = arrayindex(regextract(_raw_log, "\[?UserName\]?=\[?([^~\s\[\]]+)"), 0),
user_name_2 = arrayindex(regextract(_raw_log, "User=([^~\s]+)"), 0),
user_name_3 = arrayindex(regextract(_raw_log, "User Context:\s+([^~\s]+)"), 0),
user_name_4 = arrayindex(regextract(_raw_log, "User -\s+\[([^~\s\]]+)"), 0),
user_name_5 = arrayindex(regextract(_raw_log, "user name \[([^~\s\]]+)"), 0),
user_name_6 = arrayindex(regextract(_raw_log, "\[User ([^~\s]+)"), 0),
user_domain = arrayindex(regextract(_raw_log, "UserName=([^\\]+)\\"), 0)
| alter
user_name = coalesce(user_name_1, user_name_2, user_name_3, user_name_4, user_name_5, user_name_6)
| alter
duration = coalesce(duration1 , duration2, duration3),
component = coalesce(component, component2),
msg = coalesce(msg_1, msg_2),
event_type = if(event_type contains "CMGService", "CMGService", event_type contains "SMSPXE", "SMSPXE", event_type),
user_name = if(user_name contains """\\""", arrayindex(regextract(user_name, "\\([\S]+)"), 0), user_name)
| alter
xdm.session_context_id = thread_id,
xdm.event.description = msg,
xdm.event.operation = component,
xdm.source.ipv4 = ipV4,
xdm.target.file.filename = coalesce(filename,file),
xdm.target.file.path = path,
xdm.network.dns.dns_resource_record.name = dns_name,
xdm.observer.name = site_server,
xdm.event.duration = to_number(duration),
xdm.event.type = event_type,
xdm.event.log_level = if(log_prefix contains "info", XDM_CONST.LOG_LEVEL_INFORMATIONAL, log_prefix contains "debug", XDM_CONST.LOG_LEVEL_DEBUG, log_prefix contains "alert", XDM_CONST.LOG_LEVEL_ALERT, log_prefix contains "crit", XDM_CONST.LOG_LEVEL_CRITICAL, log_prefix contains "error", XDM_CONST.LOG_LEVEL_ERROR, log_prefix contains "warn", XDM_CONST.LOG_LEVEL_WARNING, log_prefix contains "notice", XDM_CONST.LOG_LEVEL_NOTICE, to_string(log_prefix)),
xdm.source.user.domain = user_domain,
xdm.source.user.username = user_name;