Really nice post, I wonder if we can build on top of this and grab the entire matched content. 

I.e: 
String to match:
foo bar string argz bruh
foo foo foo foo foo foo foo
bar bar bar bar bar bar 

pattern defined:

{ foo foo| bar bar | foo bar | bar foo } {s: string} {random : (string*)}

would be nice to be able to get item.data.all be the entire “foo bar string argz bruh”,“foo foo foo foo foo foo foo”,”bar bar bar bar bar bar”( without having to write 3 NQE methods or define other pattern to match each separately) or the entire of the 2 pattern instead of just item.data.name or item.data.random. 

@huutho5011 Check out my series on pattern matching → 

Some is possible but as of now doing option handling can be a bit verbose.

@GaryB Actually, you gave me a great idea, never thought about it this way.

So for context, I am trying to do this: 

logging {"host inside"|"host"|"server"|"vrf MGMT host"|empty} {ip:ipv4Address} {misc:(string*)}

Since the environment is not 100% templatized, and this is feed into automation for decom and roll back, so we need to get the proper full line.

Looking at your code, I remember FWD only ever allow 1 pair of L/R logic in a block/pattern matches, and you all do save it as a match.data output ( as left/right).

All I need to do is reverse your shift left logic to know which of the 4 was matched( although it is a bit of a pain)

Sharing if someone else ever run into this edge case.

Mainly because this is a thing in IOS 

logging ip
logging ip
logging ip
logging host ip transport tra port port
logging host ip transport tra port port

@huutho5011 in this case, if you want to pull every line that starts with logging you can use

foreach device in network.devices
foreach match in patternMatches(device.files.config, `logging`)
select{
  device:device.name,
  match:match.line.text
}

and if you only want the logging lines that contain an ip 

pattern = `logging {(!ipv4Address string)*} {ip:ipv4Address}`;

foreach device in network.devices
foreach match in patternMatches(device.files.config, pattern)
select{
  device:device.name,
  match:match.line.text
}

 @AricaFN Thanks Arica, 

Mine is a bit like this, for specific use case that I have, in getting only the lines with ip and also getting the entire line for decom/roll back 

pattern=```
logging {"host inside"|"host"|"server"|"vrf MGMT host"|empty} {ip:ipv4Address} {garbo:(string*)}
```;
foreach device in network.devices
foreach command in device.outputs.commands
where command.commandType==CommandType.CONFIG
let cfg=parseConfigBlocks(OS.OTHER,command.response)
let match=(foreach match in blockMatches(cfg,pattern)
    let log_text= if isPresent(match.data.right) then ""
        else if isPresent(match.data.left?.right) then "vrf MGMT host"
              else if isPresent(match.data.left?.left?.right) then "server"
                  else if isPresent(match.data.left?.left?.left?.right) then "host"
                      else if isPresent(match.data.left?.left?.left?.left) then "host inside
                            else "not handled"
                 select "logging "+log_text +" "+toString(match.data.ip)+" "+join(" ",match.data.garbo))
//                  select match.data.ip)
where length(match)>0
select{
  deviceName:device.name,
  os: device.platform.os,
  cmd.resp: command.response,
  match:match
}
 

@huutho5011 I see, thanks for the insight! Your query is great for accessing each possibility and extracting it if you need to know each type later on. In order to achieve the result you’re looking for in this specific query, this should do the trick. It will search each line in the config to find all lines that begin with logging and have an ip address and the result will return the entire line for every match. This way will also show you where exactly it was found in the config. 

pattern = `logging {(!ipv4Address string)*} {ip:ipv4Address}`;

foreach device in network.devices
let lines = (foreach match in patternMatches(device.files.config, pattern) select match.line.text)
where length(lines) > 0
select{
  device:device.name,
  lines
}

Arica and @huutho5011 
This is exactly what I was hoping for this community to be!

I’ve been trying to solve for this kind of ‘config sprawl’  for a few months.  huutho5011, we are in the same boat, of ‘not being templatized’ and trying to find the outliers has been difficult with the simple checks, b/c there is so many variation, examples below. Some using VRF’s, some using the wrong UDP/TCP port etc… 

The combo of the examples you guys put together have gotten me closer. 
 

I would like to see which devices have ‘NO LOGGING configured’, but I’m not sure that’s a simple add-on to this. But for now, at least I can export and do some excel manipulations to find the misconfigured devices.

Thanks for the work!
Rich

Rich,

If you use “foreach” or “where” to see which devices have logging configured, then you don’t get to see the devices that “don’t” match.  That is where “let” statements are useful.  The “let” does not filter out data.  It just files in a variable.

You could do something like

pattern01 = ```
logging server {serverIp:ipv4Address}
```;

pattern02 = ```
logging host {serverIp:ipv4Address}
```;

pattern03 = ```
logging {serverIp:ipv4Address }
```;

foreach device in network.devices
where device.platform.vendor == Vendor.CISCO
let logServ = blockMatches(device.files.config, pattern01)
let logHost = blockMatches(device.files.config, pattern02)
let logIp = blockMatches(device.files.config, pattern03)
let logging = logServ + logHost + logIp
let violation = length(logging) == 0 && device.snapshotInfo.result == DeviceSnapshotResult.completed
select {
  violation: violation,
  device: device.name,
  servers: (foreach record in logging
            select record.data.serverIp),
  logging: (foreach record in logging
            select record.blocks),
  Collection_Status: device.snapshotInfo.result
}

It is not beautiful.  I didn’t work too hard on how the output looks.  But it is a way to view the data.  The important part is that now you can choose “true” for violation and see the devices that are NOT configured with a logging server.

-Tyson

Another one is to use the query Arica put above, but remove the “where” clause

pattern = `logging {(!ipv4Address string)*} {ip:ipv4Address}`;

foreach device in network.devices
let lines = (foreach match in patternMatches(device.files.config, pattern) select match.line.text)
==>> where length(lines) > 0 <<== remove this
select{
  device:device.name,
  lines
}

Then it is useful to add a “violation” to quickly sort to the devices that are incorrect.

-Tyson

There are other things you can do if you have an “approved” list of logging servers.  You can make a list of “found servers”.  Then you something like

let missingServers = approved - foundServers
let extraServer = foundServers - approved

Then you can add those to a violation like:

violationMissing = length(missingServers) > 0,
violationExtra = length(extraServers) > 0

Just to illustrate that you can have more than one violation column.  If you make it a Verification check, then it is really only useful to have a single violation.  but for investigation it is useful to create multiple violation columns.

To make them a single violation you could do something like:

let violation = length(logging) == 0 && device.snapshotInfo.result == DeviceSnapshotResult.completed || length(missingServers) > 0 || length(extraServers) > 0

Sorry for a bunch of messages.  I had a few different thoughts come up.

-Tyson

pattern = `logging {(!ipv4Address string)*} {ip:ipv4Address}`;

foreach device in network.devices
let lines = (foreach match in patternMatches(device.files.config, pattern) select match.line.text)
==>> where length(lines) > 0 <<== remove this
select{
  device:device.name,
  lines
}

I’d like to Fist Bump this. one…. THANK YOU!. Perfect

Thanks Tyson/Arica et al - 

This is what I used with all different permutations of ‘logging’ in our environment. And it worked perfectly - 

pattern = `logging {"host "|"host inside"|"host"|"server"|"vrf MGMT host"|empty} {ip:ipv4Address} {misc:(string*)}`;

foreach device in network.devices
let lines = (foreach match in patternMatches(device.files.config, pattern) select match.line.text)
//where length(lines) > 0
select{
  device:device.name,
  Platform: device.platform.os,
  lines
}

let missingServers = approved - foundServers
let extraServer = foundServers - approved

violationMissing = length(missingServers) > 0,
violationExtra = length(extraServers) > 0

let violation = length(logging) == 0 && device.snapshotInfo.result == DeviceSnapshotResult.completed || length(missingServers) > 0 || length(extraServers) > 0

I’ll try this as well, if I can nail down a list in 4 global regions x 6 different options of servers ;-)