Normalization and extraction of log data

A method comprising:

• receiving a traffic log from a network device;
• determining a characterization of an extraction of data from the traffic log;
• selecting a first regular expression from a plurality of regular expressions based on the characterization of the extraction of data from the traffic log, the first regular expression configured to generate a largest amount of relevant parsed data, compared to the plurality of regular expressions, when applied to the traffic log;
• parsing the traffic log by applying the first regular expression to the traffic log according to the characterization of the extraction of data from the traffic log to generate parsed data;
• selecting a second regular expression from a plurality of regular expressions based on the characterization of the extraction of data from the traffic log, the second regular expression configured to generate a largest amount of relevant extracted data, compared to the plurality of regular expressions, when applied to the parsed data.
• extracting data from the traffic log by applying the second regular expression to the parsed data according to the characterization of the extraction of data from the traffic log to generate extracted data.