Highlighted
Trusted Contributor.. ganchu1 Trusted Contributor..
Trusted Contributor..
101 views

Replace white space character in messageid token string

Jump to solution

Can I replace to other char If space character contains flexconnecter's token string? For example: Identifier is 'Outgoing File'. I tried submessage[1].messageid="Outgoing File" but connector can't detect submessage[1] and directing to default submessage.

token[2].name=Identifier
token[2].type=String

submessage.messageid.token=Identifier

submessage[1].messageid=Outgoing_File
submessage[1].pattern.count=1
submessage[1].pattern[0].regex=%INFO.*Name\\s+Outgoing File(.*)
submessage[1].pattern[0].fields=event.fileName

0 Likes
1 Solution

Accepted Solutions
mschleich Acclaimed Contributor.
Acclaimed Contributor.

Re: Replace white space character in messageid token string

Jump to solution

Hi Ganchu1,

 

I don't see your complete properties file thus I am not sure if you have forgotten or not the following properties:

submessage.messageid.token=SubmessageIdToken
submessage.token=SubmessageToken

Where SubmessageIdToken and SubmessageToken are tokens setup initially.

You have to try this:

submessage[1].messageid=Outgoing File

without double quotes and without underscore. If you have properly defined your token, it should work.

Or, I invite you to use another field for the messageID like the eventID or what is saved into [deviceEventClassId] ArcSight field.

Could you please tell us which logs type you are trying to parse?

If you have any question or if you need more info, do not hesitate to contact me.

 

Thanks
Regards

Michael

0 Likes
1 Reply
mschleich Acclaimed Contributor.
Acclaimed Contributor.

Re: Replace white space character in messageid token string

Jump to solution

Hi Ganchu1,

 

I don't see your complete properties file thus I am not sure if you have forgotten or not the following properties:

submessage.messageid.token=SubmessageIdToken
submessage.token=SubmessageToken

Where SubmessageIdToken and SubmessageToken are tokens setup initially.

You have to try this:

submessage[1].messageid=Outgoing File

without double quotes and without underscore. If you have properly defined your token, it should work.

Or, I invite you to use another field for the messageID like the eventID or what is saved into [deviceEventClassId] ArcSight field.

Could you please tell us which logs type you are trying to parse?

If you have any question or if you need more info, do not hesitate to contact me.

 

Thanks
Regards

Michael

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.