Hi, banging my head...
04/22/2016 09:23:50,865 - ERROR - exception occurred --- FOO BAR
Severity: Error
Message: Timeout expired.
MachineName: MY MACHINE
04/22/2016 09:23:56,318 - ERROR - exception occurred --- System.Data.SqlClient.SqlException: Timeout expired. The timeout period elapsed prior to completion of the operation or the server is not responding.
at System.Data.SqlClient.SqlConnection.OnError(SqlException exception, Boolean breakConnection)
I have a single log file that contains the two formats. What I want to do is if the entry has "Message:", then make this the extracted field ErrorMessage, Else If the entry have "ERROR" then, make this the extracted field ErrorMessage.
(?:Message:)|(?:ERROR -)|\s+(?P(?:[^\n]*)) this is the regex I started with and modified with few things and I still can't get it right.
Help appreciated.
Thank you,
Chris
You could do 2 field extractions both producing the same field name ErrorMessage
props.conf
[yoursourcetype]
EXTRACT-1 = Message:\s+(?<ErrorMessage>[A-Za-z0-9 ]+)
EXTRACT-2 = \d{2}\/\d{2}\/\d{4}\s\d{2}:\d{2}:\d{2},\d{3}\s-\sERROR\s-\s(?<ErrorMessage>.+)
That regex isn't the best in the world but you can keep tweaking it to suit your needs
Be sure to add all the possible characters you may see after "Message:" in this part of the regex [A-Za-z0-9 ]
You could do 2 field extractions both producing the same field name ErrorMessage
props.conf
[yoursourcetype]
EXTRACT-1 = Message:\s+(?<ErrorMessage>[A-Za-z0-9 ]+)
EXTRACT-2 = \d{2}\/\d{2}\/\d{4}\s\d{2}:\d{2}:\d{2},\d{3}\s-\sERROR\s-\s(?<ErrorMessage>.+)
That regex isn't the best in the world but you can keep tweaking it to suit your needs
Be sure to add all the possible characters you may see after "Message:" in this part of the regex [A-Za-z0-9 ]
Thanks, but wouldn't that still execute both EXTRACTs? I just want One or the Other.
Chris
Give it a try, I may be wrong, but I think you'll only only see EXTRACT-2 as ErrorMessage if EXTRACT-1 doesn't exist. Either that or it'll create a multi value field.
Thanks. You look to be correct! Its working.
Chris
Good stuff!