what is the correct way to parse a log like this?
[quote]
01:06:17.577 statuscode: 2,09
01:06:17.577 statuscode: 0,21
01:06:17.581
******************************************************************
01:06:17.581 <transaction>
<customer-language>en</customer-language>
<shop>
<code>7</code>
<description>MAIN</description>
</shop>
</transaction>
01:06:17.581
******************************************************************
01:06:17.577 statuscode: 3,12
01:06:17.730 MainEvent: BarcodeCommand Enable
01:06:17.730 End InitTransaction
[/quote]
Mixed parsed log - is it possible?
Posted on Jan 10, 2024 at 9:44 AM
Posted on Jan 10, 2024 at 10:28 AM
Hi Jack,
This is a tricky log file because you actually have multiple formats in the same file (the log entries have different metadata). The Basic Parser (default parse) does a pretty good job. You can set this parser type explicitly in Parser Mappings.
Alternatively, you can use a multi-pattern with a Pattern Parser to get a result that is a little bit better.
Hope that helps,
Toby
This is a tricky log file because you actually have multiple formats in the same file (the log entries have different metadata). The Basic Parser (default parse) does a pretty good job. You can set this parser type explicitly in Parser Mappings.
Alternatively, you can use a multi-pattern with a Pattern Parser to get a result that is a little bit better.
%d{HH:mm:ss.fff} %m%n
%d{HH:mm:ss.fff}%n%m%nHope that helps,
Toby
This topic is closed and cannot receive new replies.