locked
Parsing text log messages that differ on the last set of characters RRS feed

  • Question

  • Similar problem to a previous post:

    Parsing text log messages that differ on the last character

    Hi

    I'm sure this is a failing in my grasp of regex but testing with the .NET Regular Expression Tester isn't getting me anywhere.

    I want to differentiate text log lines based on the last set of characters. Suppose my log file looks like this -

    2016-08-01 06:22:09 SYNC: Set board to 1 second pulse
    2016-08-01 06:27:01 SYNC: Sent a time at message with: Mon Aug 01 09:27:05 2016

    Based on the OPN Configuration Guide for Text Log Adapter v2, I think my parser should look something like below; I have removed references to other "categories" of messages, leaving only the "SYNC" type.

    message SyncEventHdr with
        EntryInfo { Tag = "SYNC:", Regex = @"\sSYNC:\s" } : EventHeader
    {
        string Category = "SYNC";
        string Msg = "";
        string DTText = "";
    }

    message SyncEventNoTime with
        EntryInfo { Regex = @"\sSYNC:\s(?<Msg>.*)",  Priority = 2 } : SyncEventHdr
    {
    }

    message SyncEventWithTime with
        EntryInfo { Regex = @"\sSYNC:\s(?<Msg>.*?)\s(?<DTText>\w{3}\s\w{3}\s\d{2}\s[:\d]{8}\s\w{4})",  Priority = 1 } : SyncEventHdr
    {
    }

    Its ok when I use regex tester to check for both Regex's, but running in MA, only the second inherited message type, SyncEventWithTime is always used to parse the two types of SYNC messages, resulting in parsing errors for SYNC messages without date-time text at the end of the message.

    Please kindly advise on the way forward on this problem.

    Thanks.


    • Edited by juandering Wednesday, August 3, 2016 11:46 AM
    Wednesday, August 3, 2016 11:43 AM

Answers

  • As noted earlier, this post is based on an earlier post:

    "Parsing text log messages that differ on the last character"

    and the solution, which of course I did not realize early on (duh moment :), is basically the same; which is as per Mr. Paul E. Long:

    "You can define two different sets of RegEx for inherited messages, so instead just copy that part over for each message and don't put any regex on mHeader."

    This principle solution helped me in this case.

    Kudos to Paul E. Long.

    • Marked as answer by juandering Monday, August 8, 2016 6:11 PM
    Monday, August 8, 2016 6:10 PM

All replies

  • Screen capture below for original Priorities (2,1):


    • Edited by juandering Wednesday, August 3, 2016 11:53 AM
    Wednesday, August 3, 2016 11:45 AM
  • If I swap the Priorities (2,1 to 1,2), then only SyncEventNoTime is used to parse SYNC messages, resulting in null DTText fields even for messages with date-time text at the end.
    Wednesday, August 3, 2016 11:52 AM
  • As noted earlier, this post is based on an earlier post:

    "Parsing text log messages that differ on the last character"

    and the solution, which of course I did not realize early on (duh moment :), is basically the same; which is as per Mr. Paul E. Long:

    "You can define two different sets of RegEx for inherited messages, so instead just copy that part over for each message and don't put any regex on mHeader."

    This principle solution helped me in this case.

    Kudos to Paul E. Long.

    • Marked as answer by juandering Monday, August 8, 2016 6:11 PM
    Monday, August 8, 2016 6:10 PM