topic Re: Capturing logs using regex in Getting Data In

Capturing logs using regex

nikhilagrawal — Wed, 27 Jun 2012 09:23:13 GMT

Hi,I've below log lines in below
format:

1) D:\SystemX\XManager\TEST1_XM_5_1_0_361\Director\GenericService.log

2) D:\SystemX\XTrader\TEST1_XM_5_1_0_361\Director\GenericService.log

3) D:\SystemX\XInterface\TEST1_XM_5_1_0_361\Director\GenericService.log

How can I get the logs under D:\SystemX\...... I have created field extract filter to seperate XManager, XTrader and Xinterface and I want to view logs in a way that if I select XManager I will see all logs under D:\SystemX\XManager\.. and so on.
The regex i was trying : ^\w+\:\\SystemX\\(?<app>[A-Za-z]*)
But it showing error.

I really appreciate your help.
Thanks

Re: Capturing logs using regex

Lamar — Wed, 27 Jun 2012 14:08:05 GMT

Nik,

I'm curious why you're not just sourcetyping these...ie:

In props.conf.

[source::.../XManager/.../GenericService.log]
sourcetype = XManager

[source::.../XTrader/.../GenericService.log]
sourcetype = XTrader

[source::.../XInterface/.../GenericService.log]
sourcetype = XInterface

That way, when you search on them you just type:

sourcetype = XManager <rest of your search>

You will get all of the files (regardless of which version they are) that have XManager in the directory structure and end with the filename of GenericService.log.

Hope that helps.

Re: Capturing logs using regex

nikhilagrawal — Mon, 28 Sep 2020 12:00:02 GMT

Thanks for suggestion. I should have think this before. I tried the above changes in prop.conf but its not working.
1) I am looking log files from windows machine so I changed the forward slash to backward.

[source::...\XManager\...\GenericService.log]
sourcetype=XManager

Exact location:
D:\SystemX\XManager\TEST1_XM_5_1_0_366\Director\GenericService\Logs\SystemX\GenericService.log

I just have to make the changes under deployment server not on the indexer right?

Please let me correct if I am wrong.
thanks, Nik

Re: Capturing logs using regex

Lowell — Wed, 27 Jun 2012 19:50:22 GMT

Try switching from slashes to backslashes. Remember the backslashes need to be escaped, i.e. \\. (Or, setup a rule that allow for both unix and windows separators using something like this: [source::...[/\\]XInterface[/\\]...[/\\]GenericService.log]. It looks funny, but it should work.