Help : Need Regex Mapping

[jayakrishnan_p1]

Hi,

Can anyone help to write Regex Mapping for below events.

2014-05-02 00:56:15,678 [http-localhost%2F127.0.0.1-9300-13] INFO  com.hp.ov.cr.auth.cognos.ErsAuthenticationProvider  Internal logon request with User: ErsAdmin

2014-05-02 00:56:15,881 [http-localhost%2F127.0.0.1-9300-13] INFO  com.hp.ov.cr.auth.cognos.ErsAuthenticationProvider  User ErsAdmin logged off.

2014-05-02 00:56:15,881 [http-localhost%2F127.0.0.1-9300-5] INFO  com.hp.ov.cr.auth.cognos.ErsAuthenticationProvider  logon request from NNMi trusted User: opcprado, Role: level1, UserGroups: level1

2014-05-02 01:02:00,585 [http-localhost%2F127.0.0.1-9300-13] INFO  com.hp.ov.cr.auth.cognos.ErsAuthenticationProvider  User opcprado logged off.

There are 3 events above.

I would like map it as three columns.

Eg: deviceReceiptTime  (eg: 2014-05-02 00:56:15,678)

Action  (eg: [http-localhost%2F127.0.0.1-9300-13] INFO  com.hp.ov.cr.auth.cognos.ErsAuthenticationProvider  Internal logon request with User)

UserName (eg: ErsAdmin)

There is UserName in each event. I need to fetch that mainly.

Please help.

Thanks & Regards

Jayakrishnan

[smazhar]

Hi,

Check with the below regex to capture 3 fields

(\d+)\-(\d+)\-(\d+) (\d\d:\d\d:\d\d),(\d+) \[http\-localhost%(\d+)F(\d+\.\d+\.\d+\.\d+)\-(\d+)\-(\d+)\] INFO  (\S+)  Internal logon request with User: (\S+)

Regards, Mazhar

[rhope]

You're probably going to be best served by using sub messages to parse the three different event types, the regex provided above only caters for the first event ( see slide 31 onwards in ).  If you really want to do it with a single regex the the following works though you'll need to wrap the username in an __Replace() to get rid of the comma from the third event.

^(\S+\s\S+) (\[[^]]+\]) (\S+)\s+(\S+)\s+(.*User(?::)? (\S+).*)

Properties file/Java Friendly version

"^(\\S+\\s\\S+) (\\[[^]]+\\]) (\\S+)\\s+(\\S+)\\s+(.*User(?::)? (\\S+).*)"

Produces the following captures:

Event 1

group 1: 2014-05-02 00:56:15,678

group 2: [http-localhost%2F127.0.0.1-9300-13]

group 3: INFO

group 4: com.hp.ov.cr.auth.cognos.ErsAuthenticationProvider

group 5: Internal logon request with User: ErsAdmin

group 6: ErsAdmin