how do I resolve the parsing for this log file


Author
Message
bdroye
bdroye
New Member (3 reputation)New Member (3 reputation)New Member (3 reputation)New Member (3 reputation)New Member (3 reputation)New Member (3 reputation)New Member (3 reputation)New Member (3 reputation)New Member (3 reputation)
Group: Forum Members
Posts: 2, Visits: 13
I have a log file that is an html file.  I find the documentation lacking here but I got about 80 percent of this parsing licked
the log entry looks like this :

<tr>
<td>21-10-06 09:04:15.862 PDT</td>
<td title="Thread-129 thread">Thread-129</td>
<td title="Level"><font color="#339933">DEBUG</font></td>
<td title="org.hibernate.type.StringType category">org.hibernate.type.StringType</td>
<td>NullableType.java:133</td>
<td title="Message">binding 'BatchPrtd' to parameter: 2</td>
</tr>
The <tr>'s I set to 'ignore'
When I set the second item to Thread it inactivates the next button and I can't apply the parsing I have set up. See the attached image.
Also why doesn't LogView Plus show all the log entries?  Some are missing for no rhyme or reason.  How do I correct that?
Thank you.

LogViewPlus Support
LogViewPlus Support
Forum Expert (925 reputation)Forum Expert (925 reputation)Forum Expert (925 reputation)Forum Expert (925 reputation)Forum Expert (925 reputation)Forum Expert (925 reputation)Forum Expert (925 reputation)Forum Expert (925 reputation)Forum Expert (925 reputation)
Group: Moderators
Posts: 656, Visits: 2K
Hi BDroye,

Thanks for reaching out.  This is a tricky file to parse, but I think what you are looking for is something like:

<tr>\n<td>%d{yy-MM-dd %H:mm:ss.fff ZZZ}</td>\n<td title="%S">%t</td>%S<font color="%s">%p</font>%S<td title="Message">%m</td>\n</tr>%n




The trick here is using %S to skip large areas of non-repeating text that we want to ignore.  %s is also used for the few times where we want to skip a single word.  It is important to use the constants like "<font color=" to break the multi-line %S read and setup the structured data we want to extract - %p. 

Note that the log parser configuration provided must match all log entries in the log file.  If one log entry does not match, the parser will keep moving forward on until all criteria have been fulfilled.  This behavior can give the appearance of "missing" log entries in the grid if the parser configuration is not valid.  The log data is always there (and searchable) but it may have been aggregated into the previous log entry.

Hope that makes sense.  Please do let me know if you have any further questions or issues.

Toby
bdroye
bdroye
New Member (3 reputation)New Member (3 reputation)New Member (3 reputation)New Member (3 reputation)New Member (3 reputation)New Member (3 reputation)New Member (3 reputation)New Member (3 reputation)New Member (3 reputation)
Group: Forum Members
Posts: 2, Visits: 13
too would like to see that result that this presented here in the solution. But it is not clear what I have to change to get there.  That one liner was not completely helpful and the distinction between %s and %S is to fine for me to know how to apply it. I do see why I don't see the all the log entries as a log entry. Thanks.
This might be a new grievance but why don't a see the all the columns in  the lower left.  I did at one time see the column on the left; I no longer see it.  I haven't seen any icon or menu item that will allow me adjust and correct this.

LogViewPlus Support
LogViewPlus Support
Forum Expert (925 reputation)Forum Expert (925 reputation)Forum Expert (925 reputation)Forum Expert (925 reputation)Forum Expert (925 reputation)Forum Expert (925 reputation)Forum Expert (925 reputation)Forum Expert (925 reputation)Forum Expert (925 reputation)
Group: Moderators
Posts: 656, Visits: 2K
Hi BDroye,

Apologies for the slow reply.  We recently migrated servers and I unfortunately missed the notification update.

The difference between %S and %s is that the upper case version matches multiple words, where the lower case version only matches a single word.  In not providing a column name for the parsed data, we are instructing LogViewPlus to ignore the data.  It will not be displayed, but including the literal values in the parser configuration might confuse the parser.

I think the missing columns on left side of the application might be a new problem introduced in the latest release.  I noticed this problem the other day as well.  What happened to me is that the left column was still there, but there was no room for it.  If you mouse close to the left side of the application, your cursor should change and you should be given the option to expand the area.



Is this the problem you are having?

Hope that helps,

Toby
GO

Merge Selected

Merge into selected topic...



Merge into merge target...



Merge into a specific topic ID...




Similar Topics

Login

Explore
Messages
Mentions
Search