Group: Forum Members
Posts: 3,
Visits: 18
|
N.B. I use monitor folder and don't specify a specific parser for each file. Every time I open an application log I was constantly getting the conflict dialog. I'd edit it, and then would happen again next time. I didn't realize I'd deleted my previous secondary application.log parser and mapping. I wasn't entirely aware I was constantly editing the same parser config over and over again. However even after recreating it, the problem remained. I confirmed I was using heuristic parser selection.
Solution: I paid a lot more attention to the patterns I was using, and how the test-files work with each. Tweaking the auto-detected format, converting "S" to "s", and removing length limits on "%m".
I collated several samples and, then tested each parser's pattern until they were robust. Previously I would always get the same "broadest" parser used in the conflict dialog, which made it difficult to identify the issue with the parser I wished to use. After ensuring the parsers did not error, heuristic selection is now using the correct parser, despite the multiple possible options. FTW!
|