LogViewPlus Support

Parsing smsts.log file

https://www.logviewplus.com/forum/Topic592.aspx

By eugenius - 12 Jun 2020

Hi,

I'm trying to parse a smsts.log file, which is like below:
<![LOG[ log text mesage]LOG]!><time="16:33:53.212-60" date="06-11-2020" component="InstallSoftware" context="" type="1" thread="2168" file="downloadcontent.cpp:526">


I want to parse and display the text like below:
"log text mesage" in a "Log Text" column
"06-11-2020" and "16:33:53" if possible in a single "Date/Time" column, like "11.06.2020 16:33:53"  ;  if not, these can be in 2 separate "Date" and "Time" columns
"InstallSoftware" in a "Component" column
"2168" in a thread column

Can you please help me to get started?
I've tried with the Parser Wizard but, due to my inexperience, I can't get a valid configuration.

Thank you.
           
							
		

	
		
				      		    
		

		
            
            
            By LogViewPlus Support - 14 Jun 2020				
            

                    
            Hi,

Apologies for the delay in getting back to you.  You can parse this file using a PatternParser with the pattern:

<![LOG[%m]LOG]!><time="%d{%H:mm:ss.fff%z}" date="%d{dd-MM-yyyy}" component="%S{component}" context="%S{context}" type="%S{type}" thread="%S{thread}" file="%S{file}">%n




This gives the output:



Hope that helps,

Toby
           
							
		

	
		
				      		    
		

		
            
            
            By LogViewPlus Support - 14 Jun 2020				
            

                    
            Looking at this a bit more closely, there are a few issues.

The first is that the date column is missing and needs to be added manually.  I am not sure why this is happening - it could be a bug.  I will take a closer look and get back to you.  In the meantime, you can add the date column from the grid column context menu:



The second is the timestamp 16:33:53.212-60.  What is the "-60"?  I have not seen this format before.  I believe LogViewPlus will treat this as a timezone offset and subtract 60 hours - which doesn't make sense.  

Assuming -60 is constant with the log files you are viewing, you would get a better parse if you ignore it with:

time="%d{%H:mm:ss.fff}-60"


Hope that helps,

Toby

           
							
		

	
		
				      		    
		

		
            
            
            By eugenius - 16 Jun 2020				
            

                    
            Hi,

Wow, it's perfect!

Yes, "-60" is constant. I don't know why it's configured this way.

Thank you very much.
           
							
		

	
		
				      		    
		

		
            
            
            By LogViewPlus Support - 16 Jun 2020				
            

                    
            Great - thanks for letting me know.  I will take a look at those other issues for the next release.

FYI, another option would be:
time="%d{%H:mm:ss.fff}-%s"


This puts the "60" into a string variable which is then ignored.  The advantage of this approach is that it allows any single word instead of a constant.

Thanks again,

Toby   
           
							
		

	
		
				      		    
		

		
            
            
            By LogViewPlus Support - 29 Jun 2020				
            

                    
            I just wanted to give you a quick update on this.  We have now released LogViewPlus v2.4.36 as a BETA release.  This version resolves the issue with the Date column not being initially visible (discussed above).

It's a minor issue - but I thought you might want to know.

Thanks,

Toby