Parsing Mod Security rules - linux

Question

I need to parse modsec logs so only the date and ID of the triggered rule would display.
For example, I have such log:
[Fri Jan 29 19:12:14 test test] [:error] ModSecurity: Warning. detected XSS using libinjection. [file "/etc/apache2 r_configs/OWASP3/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line "37"] [id "941100"] [rev "2"] [msg "XSS Attack Detected via libinjection"] [data "Matched Data: x-forwarded-for found within ARGS:data[]: [vc_row full_width=\x22stretch_row\x22 initial_loading_animation=\x22fadeIn\x22 show_overlay=\x221\x22 pofo_enable_responsive_css=\x221\x22 pofo_hidden_markup_1507889268_2_40=\x22\x22 css=\x22.vc_custom_1608665830226{background-image: url(https://argeoslab.tech/wp-content/uploads/2020/12/geniemebanner.jpg?id=22321) !important;}\x22][vc_column width=\x221/4\x22 pofo_hidden_markup_1507901669_2_21=\x22\x22 pofo_hidden_markup_1507901601_2_49=\x22\x22 of..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-xss"]
I would need to get the date at the beginning and then the ID. I can get the ID with this:
awk '{for (I=1;I<NF;I++) if ($I == "[id") print $(I+1)}'
I've tried to pipe it with second awk which would work this way, but the if statement would go for $i == "Fri" || $i == "Mon" and so on, but it did not work well.
However, I cannot figure out how I would get both the date ([Fri Jan 29 19:12:14) and the ID.
I initially get the output with grep of modsec in apache log, so there would be a much bigger output and I need to go through each line and not only the first occurrence
Any help is appreciated, thanks

Answer 1

Probably one of these...
$ grep -Eo '\[(Sun|Mon|Tue|Wed|Thu|Fri|Sat|id)[ a-zA-Z0-9:\"]+\]' filename
[Fri Jan 29 19:12:14 test test]
[id "941100"]
$ awk -F '(] )' '{ c=0; for(i=1;i<=NF;++i) if(match($(i),/^\[(Sun|Mon|Tue|Wed|Thu|Fri|Sat|id)/)) { ++c; print $(i)"]"; if(c==2) break }}' filename
[Fri Jan 29 19:12:14 test test]
[id "941100"]
$ awk -F '(] )' '{ for(i=1;i<=NF;++i) if(match($(i),/^\[(Sun|Mon|Tue|Wed|Thu|Fri|Sat|id)/)) { if(i==1) { s=$(i)"] " } else { s=$(i)"]"; i=NF } printf("%s",s) } print "" }' filename
[Fri Jan 29 19:12:14 test test] [id "941100"]