host_regex problem

[a212830]

Hi,

I'm trying to parse the host from my logfile name, using host_regex, but it's not matching, and I'm unsure why.

My host_regex setting is: host_regex = \system-(.+).log$

My files are in the format /apps/logs/YYYY/MM/DD/system-HOSTNAME.log

The hostname can be anything - underscores, dashes, numbers, letters, uppercase, lowercase.... About the only two things that I would exclude would be spaces and special characters.

For example:

/apps/logs/2014/07/02/system-ltmblahqa02.log
/apps/logs/2014/07/02/system-ltmrEHH01-old.log
/apps/logs/2014/07/02/system-sD-9k-99sum.log

[martin_mueller]

Do post your entire inputs.conf stanza.

[richgalloway]

I think your host_regex string is only missing a backslash to escape the '.log'. This worked for me in RegExr:

system-(?<hostname>[\S]+)\.

[richgalloway]

Thanks for setting me straight.

[martin_mueller]

I hate to again nag about backslashes and dots, but in that case you'd need a backslash before the dot... else the no-spaces would match all the way to ".lo", and the dot would match the "g" 😛

I don't think the expression in and of itself is the issue. a\d+, do post your entire inputs.conf stanza.

[richgalloway]

If by "that" you mean martin_mueller's screen shot, don't worry about it. He's showing I was incorrect about the need to escape periods.
Put 'system-([\S]+).' as your host_regex string. I've had better luck when I avoid matching on '.'.

[a212830]

How would you put that in the inputs.conf? Am I missing something?

[martin_mueller]

The backslash shouldn't fix things, only disallow examples like this:

/apps/logs/2014/07/02/system-ltmblahqa02_log

Works for me with or without the backslash: