ExtractErrorLogs
ExtractErrorLogs
This view shows basic features of TemplateBasedExtractor.
Features
Sample Applications
Template Based Extractor
From a server log file, extract all the ERROR logs. Each log follows a predefined fixed structure, that consists in 4 major elements. These are: The date, the time (up to ms), the log type and finally, the description of the log. The input stream content, the template and also the extracted result (in Json format) are displayed down below.
Input file
2012-11-11 00:51:25,676 INFO - Starting Backup Manager 5.0.0 build 18536 2012-11-11 00:51:25,789 WARN - Generating Self-Signed SSL Certificate (alias = cdp) 2012-11-11 00:51:26,566 WARN - Saved SSL Certificate (alias = cdp) to Key Store /usr/sbin/r1soft/conf/comkeystore 2012-11-11 00:51:26,789 INFO - Operating System: Linux 2012-11-11 00:51:27,234 INFO - Architecture: amd64 2012-11-11 00:51:27,986 INFO - OS Version: 2.6.32-279.11.1.e16.x86_64 2012-11-11 00:51:28,123 INFO - Processors Detected: 1 2012-11-11 00:51:28,954 INFO - Max Configured Heap Memory: 989.9 MB 2012-11-11 00:51:29,276 ERROR - Unsuccessful: create index stateIndex on RecoveryPoint (state) 2012-11-11 00:51:29,980 ERROR - Index 'STATEINDEX' already exists in Schema 'R1DERBYUSER'. 2012-11-11 00:51:30,213 WARN - Invalid feature (0xECEBE6F7). 2012-11-11 00:51:30,736 INFO - Tomcat Wrapper starting 2012-11-11 00:51:30,800 INFO - Tomcat Wrapper started
Template file
<template rootElement="errorLog"> <element name="date" childrenSeparatorRegex="-" childrenOrderMatter="true"> <element name="year" extractFormat="int"/> <element name="month" extractFormat="int"/> <element name="day" extractFormat="int"/> </element> <element name="timeHMS" childrenSeparatorRegex=":" childrenOrderMatter="true"> <element name="hour" extractFormat="int"/> <element name="minute" extractFormat="int"/> <element name="second" extractFormat="int"/> </element> <element name="time" childrenSeparatorRegex="," childrenOrderMatter="true"> <element template="timeHMS"/> <element name="millisecond" extractFormat="int"/> </element> <element name="errorLog" childrenOrderMatter="true"> <element template="date"/> <element template="time"/> <element extractFormat="regex:ERROR"/> <element name="description" startingRegex="-" extractFormat="regex:(.)+(?=(\r\n))"/> </element> </template>
Extracted result
{ "Extractor": "XMLTemplateBased", "Result": { "errorLog": [ { "date": { "year": 2012, "month": 11, "day": 11 }, "time": { "timeHMS": { "hour": 0, "minute": 51, "second": 29 }, "millisecond": 276 }, "description": "Unsuccessful: create index stateIndex on RecoveryPoint (state)" }, { "date": { "year": 2012, "month": 11, "day": 11 }, "time": { "timeHMS": { "hour": 0, "minute": 51, "second": 29 }, "millisecond": 980 }, "description": "Index 'STATEINDEX' already exists in Schema 'R1DERBYUSER'." } ] } }