Below is my log,
CustomItemContainerGenerator.GenerateNextLocalContainer: Node is not the current one. in Xceed.Wpf.DataGrid.v4.5
Stack trace:
at Xceed.Wpf.DataGrid.CustomItemContainerGenerator.GenerateNextLocalContainer(Boolean& isNewlyRealized)
at Xceed.Wpf.DataGrid.CustomItemContainerGenerator.System.Windows.Controls.Primitives.IItemContainerGenerator.GenerateNext(Boolean& isNewlyRealized)
at Xceed.Wpf.DataGrid.Views.TableflowViewItemsHost.GenerateContainer(ICustomItemContainerGenerator generator, Int32 index, Boolean measureInvalidated, Boolean delayDataContext)
at Xceed.Wpf.DataGrid.Views.TableflowViewItemsHost.GenerateContainers(I
How can I extract only 'Node is not the current one' from the log and display?
If you only want to extract that exact text, than:
(?P<myfield>Node is not the current one\.)
Is that all you want to extract, or is there something associated with that string that you want to extract? If all you want to do is display that one field, there seem to be many better ways of doing that. What are you going to do with that information from the events? If all you want to do is count the number of events that contain that, then you don't have to extract that data, just search for it and do a stats count
on the results. So I'm not sure what you need from such an extraction. Please help me understand.
So I have similar such errors in my logs and I want to extract them and display only the unique ones with only the error message and nothing else. stats count does not help me here.
Time to learn some regex!
Can you help me with the regex?
Probably, but what is the point of extracting a constant text value. You don't need regex to do that. If you want to extract the message that comes after the colon to the first period, then use:
... | rex "^\S+:\s*(?P<mess>[^.]+)"
This did not help.
It gives me the output from starting of the log to the first period and not from the colon to first period.
Please help.
Hi there @ppanchal
What about this one ... | rex ":\s(?<text>[\w\s]+)\.\s" | stats count by text
Thanks that worked.
One more question,
How can I extract 'An entry with the same key already exists' from the below phrase,
423160139776 An entry with the same key already exists. in System Stack trace
This one should work for both cases.
... | rex "(?:\s|\d+\s)(?<text>[\w\s]+)\.\s" | stats count by text
Hope it helps.
Remember to accept an answer to help future readers find the solution.