Welcome Serena Central users! CLICK HERE
The migration of the Serena Central community is currently underway. Be sure to read THIS MESSAGE to get your new login set up to access your account.
Chawicha Valued Contributor.
Valued Contributor.
457 views

Parsing for mixed single and multi line logs +Callenge +Help

Hi Team,

I’m trying to build a parser for a connector that gets single-line and multiline logs mixed and I would like to have some help.

 

Single line format has several formats depending on the beginning of the log and depending these beginnings the log format is different. I solved this Creating a submessage for each beginning and some patterns according every log. This is working fine until I do the multiline part.

 

Multiline format:

XXXX word YYYY with the value:

Field1=aaaa

Field2=bbbb

.

.

lastField=xxx

 

XXXX and YYYY are a set of well-known values, let’s call them MultiLineStartN. These starts are strings (For example: horse runs, bee flies, cat jump…) which depending of the string, the number of fields of the rest of the log and the mappings change.

Following the simple-line structure, my idea is to add submessages for every beginning and then create the patterns for every case in the proper submessage. I did this creating a multiline regex with multiple ORs but I don’t know if it will work because the tool agent throws the famous “NullPointerException”.

Do we know if the tool can take multiline logs? I tried with a basic multiline regex and just only one multiline log and sometimes it takes and sometimes no so I think I have to try it in a flex connector.

 

This is how I did it:

 

do.unparsed.events=true

multiline.starts.regex=^(MultilineStart1| MultilineStart 2|…)

regex=((SimpleLineStart1| SimpleLineStart2|…|MultilineStart1| MultilineStart2|…).*)

 

Thanks in advance!

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.