<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><html><head><meta content="text/html;charset=UTF-8" http-equiv="Content-Type"></head><body ><div style="font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 10pt;"><div data-zbluepencil-ignore="true" style="" class="zmail_extra"><blockquote style="border-left: 1px solid rgb(204, 204, 204); padding-left: 6px; margin: 0px 0px 0px 5px;"><div><div style="font-family: Verdana, Arial, Helvetica, sans-serif;font-size: 10.0pt;"><div style="color: rgb(0,0,0);font-family: Verdana, Arial, Helvetica, sans-serif;font-size: 13.3333px;font-style: normal;font-weight: 400;letter-spacing: normal;orphans: 2;text-indent: 0.0px;text-transform: none;white-space: normal;widows: 2;word-spacing: 0.0px;background-color: rgb(255,255,255);">Hi,<br></div><div style="color: rgb(0,0,0);font-family: Verdana, Arial, Helvetica, sans-serif;font-size: 13.3333px;font-style: normal;font-weight: 400;letter-spacing: normal;orphans: 2;text-indent: 0.0px;text-transform: none;white-space: normal;widows: 2;word-spacing: 0.0px;background-color: rgb(255,255,255);"><br></div><div style="color: rgb(0,0,0);font-family: Verdana, Arial, Helvetica, sans-serif;font-size: 13.3333px;font-style: normal;font-weight: 400;letter-spacing: normal;orphans: 2;text-indent: 0.0px;text-transform: none;white-space: normal;widows: 2;word-spacing: 0.0px;background-color: rgb(255,255,255);">We receive aggregated syslog from a server (all logs are send from 1 IP). Also all the events are mixed.<br></div><div style="color: rgb(0,0,0);font-family: Verdana, Arial, Helvetica, sans-serif;font-size: 13.3333px;font-style: normal;font-weight: 400;letter-spacing: normal;orphans: 2;text-indent: 0.0px;text-transform: none;white-space: normal;widows: 2;word-spacing: 0.0px;background-color: rgb(255,255,255);">The name of the host sending the initial traffic is in each event.<br></div><div style="color: rgb(0,0,0);font-family: Verdana, Arial, Helvetica, sans-serif;font-size: 13.3333px;font-style: normal;font-weight: 400;letter-spacing: normal;orphans: 2;text-indent: 0.0px;text-transform: none;white-space: normal;widows: 2;word-spacing: 0.0px;background-color: rgb(255,255,255);"><br></div><div style="color: rgb(0,0,0);font-family: Verdana, Arial, Helvetica, sans-serif;font-size: 13.3333px;font-style: normal;font-weight: 400;letter-spacing: normal;orphans: 2;text-indent: 0.0px;text-transform: none;white-space: normal;widows: 2;word-spacing: 0.0px;background-color: rgb(255,255,255);">ex:<br></div><div style="color: rgb(0,0,0);font-family: Verdana, Arial, Helvetica, sans-serif;font-size: 13.3333px;font-style: normal;font-weight: 400;letter-spacing: normal;orphans: 2;text-indent: 0.0px;text-transform: none;white-space: normal;widows: 2;word-spacing: 0.0px;background-color: rgb(255,255,255);"><span class="zm_inLnk" style="border-bottom: 1.0px dashed rgb(85,85,85);cursor: pointer;line-height: 1;">2020/03/23</span><span> </span>[notice] [user] New original_source=SERV1.example.com Task=0 ....<br></div><div style="color: rgb(0,0,0);font-family: Verdana, Arial, Helvetica, sans-serif;font-size: 13.3333px;font-style: normal;font-weight: 400;letter-spacing: normal;orphans: 2;text-indent: 0.0px;text-transform: none;white-space: normal;widows: 2;word-spacing: 0.0px;background-color: rgb(255,255,255);"><br></div><div style="color: rgb(0,0,0);font-family: Verdana, Arial, Helvetica, sans-serif;font-size: 13.3333px;font-style: normal;font-weight: 400;letter-spacing: normal;orphans: 2;text-indent: 0.0px;text-transform: none;white-space: normal;widows: 2;word-spacing: 0.0px;background-color: rgb(255,255,255);">How to recover SER1 which is always preceded by "original_source=" and followed by "example.com" to save it in a file for example /data/serv1.log<br></div><div style="color: rgb(0,0,0);font-family: Verdana, Arial, Helvetica, sans-serif;font-size: 13.3333px;font-style: normal;font-weight: 400;letter-spacing: normal;orphans: 2;text-indent: 0.0px;text-transform: none;white-space: normal;widows: 2;word-spacing: 0.0px;background-color: rgb(255,255,255);">I don't want a static filter (I know how to do it) but a dynamic one. If a new event arrives at original_source=SERV2.example.com<br></div><div style="color: rgb(0,0,0);font-family: Verdana, Arial, Helvetica, sans-serif;font-size: 13.3333px;font-style: normal;font-weight: 400;letter-spacing: normal;orphans: 2;text-indent: 0.0px;text-transform: none;white-space: normal;widows: 2;word-spacing: 0.0px;background-color: rgb(255,255,255);">I would like it to automatically create a /data/serv2.log<br></div><div style="color: rgb(0,0,0);font-family: Verdana, Arial, Helvetica, sans-serif;font-size: 13.3333px;font-style: normal;font-weight: 400;letter-spacing: normal;orphans: 2;text-indent: 0.0px;text-transform: none;white-space: normal;widows: 2;word-spacing: 0.0px;background-color: rgb(255,255,255);"><br></div><div style="color: rgb(0,0,0);font-family: Verdana, Arial, Helvetica, sans-serif;font-size: 13.3333px;font-style: normal;font-weight: 400;letter-spacing: normal;orphans: 2;text-indent: 0.0px;text-transform: none;white-space: normal;widows: 2;word-spacing: 0.0px;background-color: rgb(255,255,255);">Could you help me please ?<br></div><div style="color: rgb(0,0,0);font-family: Verdana, Arial, Helvetica, sans-serif;font-size: 13.3333px;font-style: normal;font-weight: 400;letter-spacing: normal;orphans: 2;text-indent: 0.0px;text-transform: none;white-space: normal;widows: 2;word-spacing: 0.0px;background-color: rgb(255,255,255);"><br></div><div style="color: rgb(0,0,0);font-family: Verdana, Arial, Helvetica, sans-serif;font-size: 13.3333px;font-style: normal;font-weight: 400;letter-spacing: normal;orphans: 2;text-indent: 0.0px;text-transform: none;white-space: normal;widows: 2;word-spacing: 0.0px;background-color: rgb(255,255,255);">thank you in advance<br></div><div style="color: rgb(0,0,0);font-family: Verdana, Arial, Helvetica, sans-serif;font-size: 13.3333px;font-style: normal;font-weight: 400;letter-spacing: normal;orphans: 2;text-indent: 0.0px;text-transform: none;white-space: normal;widows: 2;word-spacing: 0.0px;background-color: rgb(255,255,255);"><br></div><div style="color: rgb(0,0,0);font-family: Verdana, Arial, Helvetica, sans-serif;font-size: 13.3333px;font-style: normal;font-weight: 400;letter-spacing: normal;orphans: 2;text-indent: 0.0px;text-transform: none;white-space: normal;widows: 2;word-spacing: 0.0px;background-color: rgb(255,255,255);">Pit<br></div></div><br></div></blockquote></div><div><br></div></div><br></body></html>