I'm introducing new colleagues to the marvel of LogViewPlus, and in the process, I've discovered the Save Analysis function, which is great.
However, the logfiles we're working on are full of json data, with a bunch of quotes (and then json within json, etc. it's a mess, but anyway)
I've noticed, that the log content reloaded from a saved logzip archive is not equivalent with the original log files, in particular, the json content in the message field seems to suffer, this has its quotes duplicated.
Looking at the entries, it seems, that this is probably a byproduct, that the logfiles are saved as a sort of CSV (including adding extra empty columns where needed - I have a complex parser for the original file, that does not provide values for all fields in all cases.)
Two questions:
- can the duplicated quote issue be fixed at save/load time with the current saved analysis solution?
- wouldn't it be easier to include logfiles as they are in the intial analysis, and include the used parsers with the archive? I guess, this would also have its implementation drawbacks, but you would keep the original logs intact.
a simple example. Original entry:
2021-11-23T10:21:10.883+0100; INFO ; 10.10.10.10; 0c62cf#a313efa2-8649-4dd0-8fb7-bd6013eede88; [ps-client-configurator_galatea/SelectPageRoleContextViewModel]; #Interaction Change role context to | {"role":"Rfc556a2d-4257-4fd5"};
From the logzip:
"2021-11-23 10:21:10,883",Interaction,,,0c62cf#a313efa2-8649-4dd0-8fb7-bd6013eede88,,INFO,,,10766,20211123_102103_lifeXCentral.log,10.10.10.10,ps-client-configurator_galatea/SelectPageRoleContextViewModel,,"Change role context to | {""role"":""Rfc556a2d-4257-4fd5""};"
As a side-effect, by throwing away the original log entries, some of my manually added filters in my analysis will fail as well (for example, if I filtered for #Interaction for the line above)