Hair-pulling regex issue?

[branden2]

Working on my FlexConnector... So close to having it working...

Unfortunately it's not capturing any events. Every single (50,000+) event reports this in the ArcSight log (log modified slightly for anonymity):

[2011-06-28 16:17:32,565][WARN ][default.com.arcsight.agent.sdk.a.p][parseValues] Message [230.864.286.207 - - [14/Jul/2009:12:22:29 -0400] "POST /psc/FQ9/EMPLOYEE/ERP/c/ARCHIVING.ARCH_PRJ.GBL HTTP/1.1" 200 20156 ] did not match the common regular expression [(\d+\.\d+\.\d+\.\d+)\s+\S+\s+\S+\s+\[([^\]]+)]\s+"(\S+)\s+(\S+)\s+(\S+\/\d+\.\d+)"\s+(\d+)\s+(\d+)], ignoring...

If you run that log event through the regex tool, it shows up as valid.

I've attached my properties file.

Running out of gas on this FC...

Thanks!

[chrisb1 · Accepted solution]

The logline has an extra space at the end.  Add .* to the end of the regex to capture anything extra and it should match.  It works on the regex tool because we think we're smarter than computers and don't copy and paste the extra space when testing

(\d+\.\d+\.\d+\.\d+)\s+\S+\s+\S+\s+\[([^\]]+)]\s+"(\S+)\s+(\S+)\s+(\S+\/\d+\.\d+)"\s+(\d+)\s+(\d+).*

[branden2]

You are a genius, my friend!

[chrisb1]

Nah, I just learned the Edison way :  "I have not failed 700 times. I have not failed once. I have succeeded in proving that those 700 ways will not work. When I have eliminated the ways that will not work, I will find the way that will work." -- Edison