Specifier Basics

The conversion specifiers defined by LogViewPlus give you maximum flexibility when parsing your log files.  At first glance, the full list of conversion specifiers can seem a little bit daunting.  However, you can get the most out of LogViewPlus and parse any log file using just the seven specifiers defined below.  This is your cheat sheet and learning these seven specifiers is time well spent.

Field
Specifier
Notes
Date
%d
Dates can be tricky because there are so many ways they can be represented.  See Date Patterns for more.
Thread
%t
Thread names can contain spaces, so you need a non-spaced literal separating the thread from other fields.  For example, brackets in "[my thread]".
Priority
%p
DEBUG, INFO, WARN, ERROR, etc...
Logger
%c
The logger responsible for writing the log entry.  Very helpful when filtering.
Message
%m
The log message.  When using the Pattern Parser, this specifier is almost always followed by the %n specifier.
Any Word
%s
Cheat #1 - match any string without spaces.
Multiple Words
%S
Cheat #2 - match any array of strings (spaces included).  Note this field is upper-case.

Why are %s and %S cheats?  Two reasons:  First, they are specific to LogViewPlus and not supported by standard logging frameworks like Apache Log4.   Second, the %s specifiers can optionally take a parameter which specifies the name of the column which should display the field.  To do this, you just need to enclose the column name in curly brackets.  For example: %s{My Column Name}.  This ability to take any field and convert it into a LogViewPlus column makes these specifiers extremely powerful.

The %s specifiers are the only conversion specifiers which do not have a predefined column name.  If the optional column name is not specified, then LogViewPlus will not know how to display the field.  You will still be able to use LogViewPlus to search for this text, but it will not be shown in a dedicated column in the log entry grid.

You can find out more about %s specifiers by seeing them used to parse an IIS log file. 

All conversion specifiers use the curly bracket syntax to define arguments - like {Arguments}. However the arguments supported by a given conversion specifier may be unique - as is the case with the %s specifier defined above.  Arguments are discussed in more detail in the sections that follow.

Finally, there are two additional special characters which can be used to process whitespace. 

Whitespace Field
Representation
Notes
Newline
\n
Represents a hard return which should be processed before processing continues.
Tab
\t
Represents a tab separator.  Using this character sequence is optional, but it make help to make your pattern easier to read.

Before moving onto the next section, it's worth reviewing the sample patterns discussed in Pattern Parser.  For simplicity, these examples will use timestamps only.  Date Specifiers are discussed in detail in the next section.

 
Sample Log Entries and Matching Patterns
Log Entry:
07:36|My message...
Pattern:
%d|%m%n
Notes:
The pipe character '|' is used to separate date and message.
 
 
Log Entry:
10:50 [Thread 1] INFO property1 - My message...
Pattern:
%d [%t] %p %s - %m%n
Notes:
The 'any word' specifier '%s' is used to skip over the unknown field 'property1'.
 
 
Log Entry:
10:50 [Thread 1] INFO ndc1 ndc2 ndc3 - My message...
Pattern:
%d [%t] %p %S - %m%n
Notes:
Skipping over multiple fields with the %S specifier.
 
 
Log Entry:
10:50 Thread 1 - My message...
Pattern:
%d %t - %m%n
Notes:
The multi-word thread name can be parsed thanks to unique literal ' - '.
 
 
Log Entry:
10:50|240 1 I 2 LEVEL: Info 3
Pattern:
%d|%S LEVEL: %p %m%n
Notes:
Advanced literal ' LEVEL: ' used to specify a field.  Everything prior to the literal is skipped with the multi-word specifier '%S'.
 
 
Log Entry:
[10:50] [notice] Apache/1.3.29 (Unix) server configured -- resuming operations
Pattern:
[%d] [%p] %s (%s) %S -- %m%n
Notes:
Good use of literals to separate strings.  Ignoring non-pertinent information.
 
 
Log Entry:
[10:50] [notice] Apache/1.3.29 (Unix) server configured.
Resuming operations.
Pattern:
[%d] [%p] %s (%s) %S\n%m%n
Notes:
Same as above, but with a hard return expected before the message processing starts.

Check out Advanced Patterns for the full list of supported conversion patterns.


< >