Extract Individual Fields from Audit Log

[Cantor, Scott]

On 3/16/17, 7:32 PM, "users on behalf of Strickland, David R" <users-bounces at shibboleth.net on behalf of dstrickland at austin.utexas.edu> wrote:

> I know the format of %msg (available in logback.xml) is hard-coded, but is there any way I can get to these fields individually,
> perhaps with a custom field extraction bean?

That's what you would have to do, the field extractors I built don't have any idea how to do that. The extractors literally supply the string to output, they would have to know how to include that prefix.
 
> My use-case is that our Splunk service automatically indexes fields with the name=value syntax. While I can have Splunk
> extract these fields with a regular expression, it can get pretty expensive to run those searches.

We have Splunk (and they're using a regex of course), and they haven't mentioned to me that it impacts search time. I would have assumed Splunk just precooks all that, are you sure it would speed up searches? Not saying you're wrong.

Anyway, you're welcome to add a RFE for that, it's probably something I can add generically.

-- Scott