Regex for natural language logs
Natural language logs are presented in a sentence-like form and each event type might look different.
For example, a simple login event can be presented in the following form:
The following table shows how the properties of the natural language log in the example above, can be captured:
<13>Sep 09 22:40:40 192.0.2.12 Account JohnDoe initiated a login action from 192.0.2.24 at 01/09/2016 22:40:39 UTC
|action||initiated a (.*?) action|
|accountname||Account (.*?) initiated|
|clientIP||from (.*?) at|
Note: Writing regex for natural language logs requires you to look at the static information that surrounds the value you want to capture before you create the capture group.