Graylog2 KMS activation extrator

graylog_kms_extractor.json

{
  "extractors": [
    {
      "condition_type": "string",
      "condition_value": "activation request",
      "converters": [],
      "cursor_strategy": "copy",
      "extractor_config": {
        "regex_value": ".*0x[0-9a-f]+,\\d+,([^,]+),[0-9a-f\\-]+,[^,]+,\\d,\\d,\\d+,[0-9a-f\\-]+.*"
      },
      "extractor_type": "regex",
      "order": 0,
      "source_field": "full_message",
      "target_field": "TargetHostName",
      "title": "kms.activation.hostname"
    },
    {
      "condition_type": "string",
      "condition_value": "activation request",
      "converters": [],
      "cursor_strategy": "copy",
      "extractor_config": {
        "regex_value": ".*0x[0-9a-f]+,(\\d+).*"
      },
      "extractor_type": "regex",
      "order": 0,
      "source_field": "full_message",
      "target_field": "RequieredActivation",
      "title": "kms.activation.reqCount"
    },
    {
      "condition_type": "string",
      "condition_value": "activation request",
      "converters": [
        {
          "config": {
            "date_format": "yyyy/MM/DD HH:mm"
          },
          "type": "date"
        }
      ],
      "cursor_strategy": "copy",
      "extractor_config": {
        "regex_value": ".*0x[0-9a-f]+,\\d+,[^,]+,[0-9a-f\\-]+,([^,]+),(\\d),(\\d),(\\d+),([0-9a-f\\-]+).*"
      },
      "extractor_type": "regex",
      "order": 0,
      "source_field": "full_message",
      "target_field": "ClientTimeStamp",
      "title": "kms.extraction.timestamp"
    },
    {
      "condition_type": "string",
      "condition_value": "activation request",
      "converters": [],
      "cursor_strategy": "copy",
      "extractor_config": {
        "regex_value": ".*0x[0-9a-f]+,\\d+,[^,]+,[0-9a-f\\-]+,[^,]+,\\d,(\\d),(\\d+),([0-9a-f\\-]+).*"
      },
      "extractor_type": "regex",
      "order": 0,
      "source_field": "full_message",
      "target_field": "LicenseType",
      "title": "kms.activation.licensetype"
    },
    {
      "condition_type": "string",
      "condition_value": "activation request",
      "converters": [],
      "cursor_strategy": "copy",
      "extractor_config": {
        "regex_value": ".*0x[0-9a-f]+,\\d+,[^,]+,[0-9a-f\\-]+,[^,]+,\\d,\\d,(\\d+),([0-9a-f\\-]+).*"
      },
      "extractor_type": "regex",
      "order": 0,
      "source_field": "full_message",
      "target_field": "LicenseTTL",
      "title": "kms.activation.ttl"
    }
  ],
  "version": "0.92.3"
}