match multi-line event

bob87 — Mon, 17 Dec 2012 09:38:23 GMT

I am indexing multi-line events and would like to exclude events like the following:

2012-12-04 16:29:22.402 Some text failed:
From: ExecuteViewBasedLookupCC::Execute
Type: LogicError
Severity: Critical
Text: (vector (Null-null) 3.60206e+11 )

The rule for excluding events is the text ExecuteViewBasedLookupCC followed by (Null-null). I am using the following regular expression to match this event and redirect it to nullQueue:

REGEX=(?m)^.*ExecuteViewBasedLookupCC(?=.*(Null-null))

However it is not working. Any ideas please?

Re: match multi-line event

Ayn — Mon, 17 Dec 2012 10:14:14 GMT

You need to use the s modifier as well in order to have the dot match newlines. So (?ms)

http://www.regular-expressions.info/modifiers.html

Re: match multi-line event

bob87 — Mon, 17 Dec 2012 11:25:21 GMT

thanks, that worked!

topic match multi-line event in Getting Data In

match multi-line event

Re: match multi-line event

Re: match multi-line event