LogViewPlus Support » LogViewPlus Support » Configuration & Customization » Parsing - variable spaces and field lengths

Parsing - variable spaces and field lengths

lkeyes — Fri, 19 Mar 2021 18:06:36 GMT

Hi newbie here without a clue on the parsing..... What I'm trying to do is get the something from the following log file.
09:55:19.09 [DISP] PBX: Received Call Status [Address=581]: Call [Ref=0x00202aae] [State=Idle] [Reason=Transfer].
09:55:19.10 [DISP] QControl: Update agent state for [NameId=405], [Address=581] to [State=Login, Ready, Worktime, AutoWorkTime].
09:55:19.10 [DISP] PBX: Received Call Status [Address=581]: Call [Ref=0x00202ab0] [State=Idle] [Reason=Transfer].

The parser wizard parses the time but then then everything else is parsed as a message.

1. What I would like is is to have the the six-characters starting and ending with brackets to be a field say "Source" This would be for the [DISP] field.
2. Then there is a space and a variable number of characters that terminate in in a colon. The PBX: QControl: field. might call this "FROM"

3. Everything after the colon plus a space can be the message field.

TIME ----- SOURCE ----- FROM ----- MESSAGE

RE: Parsing - variable spaces and field lengths

LogViewPlus Support — Fri, 19 Mar 2021 18:06:36 GMT

I assumed that being a "parsing newbie" you might be new to the application. Bad assumption - sorry. :-) It sounds like the Parser Wizard has been mostly doing it's job then. Good to know.

Lines that do not match the expected pattern will still be available in the log file. Usually, these lines will be shown as part of the message of the previous line. In the case of a header, these will be show as a prefix on the log line. This information will be available when searching and filtering, but it will not be shown in the grid.

What to do about it depends on what you are trying to achieve. If you want to remove the lines, you will need some kind of pre-processor which you can integration with a Open Action. If the lines need to be parsed, but using a different format, you can consider using a multi-pattern.

Hope that helps,

Toby

RE: Parsing - variable spaces and field lengths

lkeyes — Fri, 19 Mar 2021 17:57:26 GMT

So....in that case where there are sections of a file that I want to parse.. what happens to the sections that don't fit the parsing?
Wondering if there should be some pre-processing for the file before attempting to load into LogView and what I might use for that.... some kind of text manipulation script perhaps....maybe Powershell. (I'm on Windows).

RE: Parsing - variable spaces and field lengths

lkeyes — Fri, 19 Mar 2021 17:50:00 GMT

Hi..thanks for the reply. I'm not evaluating... I've had LVP for awhile. I have the latest version. Yes it turns out there is indeed a nyumber of lines at the top of the log file (should have checked that before). I tried stripping those out and have just the info that i'm attempting to parse.

RE: Parsing - variable spaces and field lengths

LogViewPlus Support — Fri, 19 Mar 2021 17:45:10 GMT

Hi Ikeyes,

Thanks for taking the time to evaluate LogViewPlus.

When I run the ParserWizard for these log lines it suggests:
%d{%H:mm:ss.ff} [%S{Column1}] %S{Column2}: %m%n

Which is more than just the date and message. What version of LogViewPlus are you using? You could also be getting this result because your log file has additional lines which follow another format.

I can rename the columns suggested to give:
%d{%H:mm:ss.ff} [%S{Source}] %S{From}: %m%n

That seems pretty close to the parse you were looking for. Please let me know if you need additional information.

Hope that helps,

Toby