topic Re: host_regex problem in Getting Data In

host_regex problem

a212830 — Mon, 28 Sep 2020 16:58:57 GMT

Hi,

I'm trying to parse the host from my logfile name, using host_regex, but it's not matching, and I'm unsure why.

My host_regex setting is: host_regex = \system-(.+).log$

My files are in the format /apps/logs/YYYY/MM/DD/system-HOSTNAME.log

The hostname can be anything - underscores, dashes, numbers, letters, uppercase, lowercase.... About the only two things that I would exclude would be spaces and special characters.

For example:

/apps/logs/2014/07/02/system-ltmblahqa02.log
/apps/logs/2014/07/02/system-ltmrEHH01-old.log
/apps/logs/2014/07/02/system-sD-9k-99sum.log

Re: host_regex problem

richgalloway — Wed, 02 Jul 2014 13:06:49 GMT

I think your host_regex string is only missing a backslash to escape the '.log'. This worked for me in RegExr:

system-(?<hostname>[\S]+)\.

Re: host_regex problem

martin_mueller — Wed, 02 Jul 2014 13:14:25 GMT

The backslash shouldn't fix things, only disallow examples like this:

/apps/logs/2014/07/02/system-ltmblahqa02_log

Works for me with or without the backslash:

Re: host_regex problem

a212830 — Wed, 02 Jul 2014 13:15:52 GMT

How would you put that in the inputs.conf? Am I missing something?

Re: host_regex problem

martin_mueller — Wed, 02 Jul 2014 13:16:50 GMT

Do post your entire inputs.conf stanza.

Re: host_regex problem

richgalloway — Mon, 28 Sep 2020 16:59:05 GMT

If by "that" you mean martin_mueller's screen shot, don't worry about it. He's showing I was incorrect about the need to escape periods.
Put 'system-([\S]+).' as your host_regex string. I've had better luck when I avoid matching on '.'.

Re: host_regex problem

martin_mueller — Wed, 02 Jul 2014 17:13:15 GMT

I hate to again nag about backslashes and dots, but in that case you'd need a backslash before the dot... else the no-spaces would match all the way to ".lo", and the dot would match the "g" 😛

I don't think the expression in and of itself is the issue. a\d+, do post your entire inputs.conf stanza.

Re: host_regex problem

richgalloway — Wed, 02 Jul 2014 17:15:46 GMT

Thanks for setting me straight.