Here is an example of one log:
20170309 10:41:16,hostname.vagrantup.com,username,localhost,155,9823,QUERY,database_name,'select min(t.nextcheck) from httptest t,hosts h where t.hostid=h.hostid and mod(t.httptestid,5)=4 and t.status=0 and h.proxy_hostid is null and h.status=0 and (h.maintenance_status=0 or h.maintenance_type=0)',0
Here is an example of another log:
20170309 10:40:44,hostname,username,localhost,222,0,CONNECT,database,,0
Here is the format:
[timestamp],[serverhost],[username],[host],[connectionid],[queryid],[operation],[database],[object],[retcode]
So I am stuck trying to get this correctly setup to have each field configured correctly. As you can see the logs differ based on what type of operation is taking place.
When the operation is a query they will likely have several commas inside of single quotes. Any help will be much appreciated.
Thanks
I was able to ingest your data successfully using the Add Data Wizard, using the following changes...
Accepting all the other defaults worked for me!
I was able to ingest your data successfully using the Add Data Wizard, using the following changes...
Accepting all the other defaults worked for me!
Thanks this worked out great.
I've done this a while ago using a REGEX statement in my props.conf file. This regex string should get you started if you want to try that approach.
(?<ts>[^,]+),(?<serverhost>[^,]+),(?<username>[^,]+),(?<host>[^,]+),(?<connectionid>[^,]+),(?<queryid>[^,]+),(?<operation>[^,]+),(?<database>[^,]+),(?<object>'?.*'?),(?<retcode>\d+)