zabbix log + regexp

[laredoeneko]

Hello
I am very new in zabbix and I am making some test with zabbix trying to parse log messages from a server. I need extract from a log file some patther, i.e. ip address and respond time, there it is and example:
t=2020-04-20T13:45:45+0200 lvl=info msg="Request Completed" logger=context userId=1 orgId=1 uname=admin method=GET path=/login status=302 remote_addr=192.168.175.102 time_ms=90 size=24 referer=
how can I extract remote_addr and time_ms and be able to view this values in a graph? I am able to send the log to the zabbiz server, but i only can extract one value with regexp:

2020-04-20 14:47:00	t=2020-04-20T13:46:59+0200 lvl=info msg="Request Completed" logger=context userId=1 orgId=1 uname=admin method=GET path=/login status=302 remote_addr=192.168.175.102 time_ms=90 size=24 referer=
2020-04-20 14:47:00	192.168.175.102 90

but i have to process the log two times....is it possible obtain them processing log file only one time?
Best regard
laredoeneko

[gofree]

https://www.zabbix.com/documentation/current/manual/config/items/itemtypes/log_items

check Extracting matching part of regular expression

[laredoeneko]

thank you very much. may be i didn't explain correctely, I see the link, and I try it, but I only can parse one field of the log, is it possible index the message and obtain 2 , 3 pattern from the log line?

[Hamardaban]

You may use https://www.zabbix.com/documentation...ependent_items

[gofree]

thank you very much. may be i didn't explain correctely, I see the link, and I try it, but I only can parse one field of the log, is it possible index the message and obtain 2 , 3 pattern from the log line?

yes it is - check the link ive pasted and maybe also log item - especially output option in it - with it you can manipulate the output of the log - or for example extract three patterns and store only those three patterns in the order you like

hint:

output - an optional output formatting template. The \0 escape sequence is replaced with the matched part of text (from the first character where match begins until the character where match ends) while an \N (where N=1…9) escape sequence is replaced with Nth matched group (or an empty string if the N exceeds the number of captured groups).