Custom Multi-line Log Sources

An example of a custom application log is as follows:

2017-03-19 16:09:41,344 WARN [main] file.FileImportSqlDao (?(think)) - File not found (/home/exaprotect/conf/TBSMP6/report/etc/export.properties)

2017-03-19 16:09:41,344 WARN [main] config.ConfigurationFactory (ConfigurationFactory.java:127) - No configuration found. Configuring ehcache from ehcache-failsafe.xml found in the classpath: jar:file:/home/exaprotect/report_TBSMP6/webapps/ExaReport/WEB-INF/lib/ehcache-1.2.2.jar!/ehcache-failsafe.xml

java version "1.8.0_18"

Java(TM) SE Runtime Environment (build 1.8.0_18-b07)

2017-03-19 16:09:50,723 INFO [main] config.FacesConfigurator (FacesConfigurator.java:151) - Reading standard config org/apache/myfaces/resource/standard-faces-config.xml

Java HotSpot(TM) 64-Bit Server VM (build 16.0-b13, mixed mode)

In the LogLogic^® Universal Collector Console, you can create a regex like:

^\d+-\d+-\d+\s\d+:\d+:\d+,\d+\s[^\s]+\s+\[[^\]]+\]\s

with a timeout of 3 seconds and indicating that orphaned lines are kept.

It will match the header of the multiline log (date and level), which is:

2017-03-19 16:09:41,344 WARN [main]

All the lines will be aggregated and then forwarded as a single log to LogLogic LMI. The separators are replaced by the value specified in custom separator field, until LogLogic^® Universal Collector finds another regex header.

If custom separator is \r\p\test, you obtain something like:

2017-03-19 16:09:41,344 WARN [main] file.FileImportSqlDao (?(think)) - File not found (/home/exaprotect/conf/TBSMP6/report/etc/export.properties)

2017-03-19 16:09:50,723 INFO [main] config.FacesConfigurator (FacesConfigurator.java:151) - Reading standard config org/apache/myfaces/resource/standard-faces-config.xml\r\p\test Java HotSpot(TM) 64-Bit Server VM (build 16.0-b13, mixed mode)

Contents

Index

Search Results

Custom Multi-line Log Sources