Mixed parsed log - is it possible?


Mixed parsed log - is it possible?
View
Options
Author
Message
jack_t
jack_t
jack_t
posted 3 Months Ago
New Member (14 reputation)New Member (14 reputation)New Member (14 reputation)New Member (14 reputation)New Member (14 reputation)New Member (14 reputation)New Member (14 reputation)New Member (14 reputation)New Member (14 reputation)
Group: Forum Members
Posts: 2, Visits: 4
what is the correct way to parse a log like this?


01:06:17.577 statuscode: 2,09
01:06:17.577 statuscode: 0,21
01:06:17.581

******************************************************************

01:06:17.581 <transaction>
<customer-language>en</customer-language>
<shop>
  <code>7</code>
  <description>MAIN</description>
</shop>
</transaction>
01:06:17.581

******************************************************************
01:06:17.577 statuscode: 3,12
01:06:17.730 MainEvent: BarcodeCommand Enable
01:06:17.730 End InitTransaction
Reply Like 2
LogViewPlus Support
LogViewPlus Support
LogViewPlus Support
posted 3 Months Ago
Supreme Being (5.3K reputation)Supreme Being (5.3K reputation)Supreme Being (5.3K reputation)Supreme Being (5.3K reputation)Supreme Being (5.3K reputation)Supreme Being (5.3K reputation)Supreme Being (5.3K reputation)Supreme Being (5.3K reputation)Supreme Being (5.3K reputation)
Group: Moderators
Posts: 1.1K, Visits: 3.7K
Hi Jack,

This is a tricky log file because you actually have multiple formats in the same file (the log entries have different metadata).  The Basic Parser (default parse) does a pretty good job.  You can set this parser type explicitly in Parser Mappings.





Alternatively, you can use a multi-pattern with a Pattern Parser to get a result that is a little bit better.
%d{HH:mm:ss.fff} %m%n
%d{HH:mm:ss.fff}%n%m%n






Hope that helps,

Toby
Reply Like 2
GO

Merge Selected

Merge into selected topic...



Merge into merge target...



Merge into a specific topic ID...



Submit

Similar Topics

Post Quoted Reply

Login

Explore
Messages
Mentions
Search