Hi All,
I'd like to create a props.conf for log files in this format:
DEBUG[ScriptingSession] 2013-11-30 15:52:40.869 EST: <-initialize
Here is what I have so far:
[mws_debug]
SHOULD_LINEMERGE = false
TIME_PREFIX = ^
TIME_FORMAT=%Y-%m-%d $H:%M:%S.%3N
MAX_TIMESTAMP_LOOKAHEAD = 50
EXTRACT-mws_debug = "(?
I think the field extraction is off, but I can't seem to get this to work.
Your help in modifying this stanza will be much appreciated.
Thanks!
Here is a correct regular expression; as Martin pointed out, it was full of double quotes and was not a valid regex. You should not quote your regular expression, nor should it have internal quotes. I have corrected a few other settings as well.
[mws_debug]
SHOULD_LINEMERGE = false
TIME_PREFIX = \]
TIME_FORMAT=%Y-%m-%d $H:%M:%S.%3N
MAX_TIMESTAMP_LOOKAHEAD = 50
EXTRACT-mws=(?<debug>\S+)\[(?<session>\S+)\]\s+\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2}\.\d+\s(?<status>.*)
Here is a correct regular expression; as Martin pointed out, it was full of double quotes and was not a valid regex. You should not quote your regular expression, nor should it have internal quotes. I have corrected a few other settings as well.
[mws_debug]
SHOULD_LINEMERGE = false
TIME_PREFIX = \]
TIME_FORMAT=%Y-%m-%d $H:%M:%S.%3N
MAX_TIMESTAMP_LOOKAHEAD = 50
EXTRACT-mws=(?<debug>\S+)\[(?<session>\S+)\]\s+\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2}\.\d+\s(?<status>.*)
Note that the extraction is broken into two lines in the post above, but it must be on a single line in your props.conf
I would like to use this format if possible.
The field extraction indeed is off - I don't see any double quotes in the event, but your extraction is full of them.
Does event breaking and timestamping work for you?