...
| Log Events Example | XpoLog Pattern | What will be extracted by the Regular Expression | ||
|---|---|---|---|---|
| Mon Jul 10 04:33:51 2006 ALTER DATABASE ADD LOGFILE THREAD 2 GROUP 3 ('/oradata/PROD/redo.log') SIZE 200K, GROUP 4 ('/oradata/PROD/redo.log') SIZE 200K ORA-336 signalled during: ALTER DATABASE ADD LOGFILE THREAD 2 GROUP 3 ('/oradata/PROD/redo.log') SIZE 200K, GROUP 4 ('/oradata/PROD/redo.log') SIZE 200K... | {date:Date,EEE MMM dd HH:mm:ss yyyy}{regexp:Error Code,refName=Message,(ORA-\d+)}{string:Message} | ORA-336 will be extracted to a unique column | ||
| Log Message: Error in Application at <2014-05-05 12:00:00.000> | {text:type}:{string:Message}{regexp:Date,refName=Message;columnType=date;dateFormat=yyyy-MM-dd HH:mm:ss.SSS,<(\d\d\d\d-\d\d-\d\d \d\d:\d\d:\d\d\.\d\d\d)>} | 2014-05-05 12:00:00.000 will be extracted to a unique column of type date | ||
| Log Message: Error in Application at <1399291200000> | {text:type}:{string:Message}{regexp:Timestamp,refName=Message;columnType=timestamp;dateFormat=yyyy-MM-dd HH:mm:ss.SSS,<(\d+)>} | 2014-05-05 12:00:00.000 will be extracted to a unique column of type date (which is a translation of the timestamp 1399291200000) | ||
| 2014-05-05 12:00:00.000 ERROR Failed to run application, x=1 2014-05-05 12:00:00.000 ERROR Failed to run application, y=2 2014-05-05 12:00:00.000 ERROR Failed to run application, z=3 | {date,yyyy-MM-dd HH:mm:ss.SSS} {text:Priority} {string:Message}{regexp:Error-Code,refName=Message,((x=)|(y=)|(z=))(\s*)[XPLG_PARAM(\d+)]} | This regular expression looks for numbers either after 'x=' / 'y=' / 'z=' and will extract the result under a unique column | ||
| 2014-05-05 12:00:00.000 ERROR Invalid Processing Time: 875ms | {date,yyyy-MM-dd HH:mm:ss.SSS} {text:Priority} {string:Message}{regexp:Processing-Time,refName=Message;columnType=number,Processing Time: (\d+)} | 875 will be extracted to a unique column of type number |