Trusted Contributor.. krause1 Trusted Contributor..
Trusted Contributor..
300 views

Mixed log types

Hello,

I have a problem with parsing. I want to parse multiple log types within one FlexConnector.

The logs are in a file. Even it is just an one liner and the next time it is a multi liner with XML.

The log entries are as follows:

DEBUG 09:11:08,311 [ip=1.1.1.1 {unknown}] [sid=abc123.abc_worker1] [uid=???] Login http:/1.2.3.4/login.do userId=userabc

DEBUG 09:11:08,445 [ip=1.1.1.1 {unknown}] [sid=abc123.abc_worker1] [uid=userabc] Login1 abc_123 communicate() data to send:

<?xml version="1.0" encoding="UTF-8"?>

<env:Envelope xmlns:env="http:/w3c....">

     <abc>

          <def>abc</def>

     </abc>

...

</env:Envelope>

DEBUG 09:11:08,645 [ip=1.1.1.1 {unknown}] [sid=abc123.abc_worker1] [uid=userabc] Login1 abc_123 communicate() answer is:

<?xml version="1.0" encoding="UTF-8"?>

<Envelope xmlns:env="http:/w3c...."><abc><def>abc</def></abc>...</env:Envelope>

INFO 09:11:08,766 [ip=1.1.1.1 {unknown}] [sid=abc123.abc_worker1] [uid=userabc] Login1 abc_123 got answer

Could the problem be solved with extraprocessors or with merged events?

And another question is, is there a possibility to get only the current date? Because I have only the time.

For the problem I tried the solution here https://www.protect724.hpe.com/message/64638#comment-64638

0 Likes
1 Reply
Micro Focus Expert
Micro Focus Expert

Re: Mixed log types

Hello!

Yes, you should be able to use an XML extra processor to parse the XML using XPATH, after processing the initial file, probably using regex.

I do not think you need to use any of the merge function, but I am not an expert on your use case or your event file.

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.