LogViewPlus Support

how do I resolve the parsing for this log file

https://www.logviewplus.com/forum/Topic1209.aspx

By bdroye - 6 Oct 2021

I have a log file that is an html file.  I find the documentation lacking here but I got about 80 percent of this parsing licked
the log entry looks like this :

<tr>
<td>21-10-06 09:04:15.862 PDT</td>
<td title="Thread-129 thread">Thread-129</td>
<td title="Level"><font color="#339933">DEBUG</font></td>
<td title="org.hibernate.type.StringType category">org.hibernate.type.StringType</td>
<td>NullableType.java:133</td>
<td title="Message">binding 'BatchPrtd' to parameter: 2</td>
</tr>
The <tr>'s I set to 'ignore'
When I set the second item to Thread it inactivates the next button and I can't apply the parsing I have set up. See the attached image.
Also why doesn't LogView Plus show all the log entries?  Some are missing for no rhyme or reason.  How do I correct that?
Thank you.
By LogViewPlus Support - 6 Oct 2021

Hi BDroye,

Thanks for reaching out.  This is a tricky file to parse, but I think what you are looking for is something like:

<tr>\n<td>%d{yy-MM-dd %H:mm:ss.fff ZZZ}</td>\n<td title="%S">%t</td>%S<font color="%s">%p</font>%S<td title="Message">%m</td>\n</tr>%n




The trick here is using %S to skip large areas of non-repeating text that we want to ignore.  %s is also used for the few times where we want to skip a single word.  It is important to use the constants like "<font color=" to break the multi-line %S read and setup the structured data we want to extract - %p. 

Note that the log parser configuration provided must match all log entries in the log file.  If one log entry does not match, the parser will keep moving forward on until all criteria have been fulfilled.  This behavior can give the appearance of "missing" log entries in the grid if the parser configuration is not valid.  The log data is always there (and searchable) but it may have been aggregated into the previous log entry.

Hope that makes sense.  Please do let me know if you have any further questions or issues.

Toby
By bdroye - 7 Oct 2021

too would like to see that result that this presented here in the solution. But it is not clear what I have to change to get there.  That one liner was not completely helpful and the distinction between %s and %S is to fine for me to know how to apply it. I do see why I don't see the all the log entries as a log entry. Thanks.
This might be a new grievance but why don't a see the all the columns in  the lower left.  I did at one time see the column on the left; I no longer see it.  I haven't seen any icon or menu item that will allow me adjust and correct this.
By LogViewPlus Support - 20 Oct 2021

Hi BDroye,

Apologies for the slow reply.  We recently migrated servers and I unfortunately missed the notification update.

The difference between %S and %s is that the upper case version matches multiple words, where the lower case version only matches a single word.  In not providing a column name for the parsed data, we are instructing LogViewPlus to ignore the data.  It will not be displayed, but including the literal values in the parser configuration might confuse the parser.

I think the missing columns on left side of the application might be a new problem introduced in the latest release.  I noticed this problem the other day as well.  What happened to me is that the left column was still there, but there was no room for it.  If you mouse close to the left side of the application, your cursor should change and you should be given the option to expand the area.



Is this the problem you are having?

Hope that helps,

Toby