Logscape Support

Members Login
Username 
 
Password 
    Remember Me  
Post Info TOPIC: data types and patterns problems


Member

Status: Offline
Posts: 13
Date:
data types and patterns problems
Permalink  
 


Hello 

I have logs from a windows server that are stored as text, Logscape seams to treat every line of the  text as new record even if several lines belong to the same record (event)

I'm trying to solve the issue creating a new data type, since each record is wrapped in curly brackets and I'm trying to use a regex expression 

but I'm having problems with Logscape as it just looks at each single line so it cannot find any match

 

I have tried

 

\{*\}

Or 

\{([^}]*)\}

 

Logscape says that there are no matches because it looks just at each single line, where my record is split on several lines

 

The log files contains records like this:

 

{"1323096967000, 1, "Information", "Application", "MBSA", "Security analysis complete.

 

Scanned from 10.75.26.40.

 

Microsoft Baseline Security Analyzer version 2.2.2170.0. " "}

 

This is a single event, but Logscape reads it as 3 events

Is there a way to have these type of events interpreted correctly by Logscape?

 

I would like to have logscape be able to see the record as one:

{"1323096967000, 1, "Information", "Application", "MBSA", "Security analysis complete. Scanned from 10.75.26.40. Microsoft Baseline Security Analyzer version 2.2.2170.0. " "} 

 

Thanks and best regards

Mark

 



__________________


Senior Member

Status: Offline
Posts: 100
Date:
Permalink  
 

Hey mark,
The line breaking is part of the datasource configuration. You would need to change the line breaking rule to be 'Explicit' (datasource->advanced) and set the entry to use '{'.
This will tell the indexer to break on lines beginning with '{' and fix the parsing problem you are seeing.

Let us know if that helps,
Regards,
Na.


__________________


Member

Status: Offline
Posts: 13
Date:
Permalink  
 

Hello

Thank you, it worked like a charm

Again thanks for the very prompt support, really appreciated!

Thanks and best regards

Mark

__________________
Page 1 of 1  sorted by
 
Quick Reply

Please log in to post quick replies.



Create your own FREE Forum
Report Abuse
Powered by ActiveBoard