XpoLog Patterns Language

Hello world. 

Hello world.

Hello
world. 

{string}

H{string} wor{string}

{string}

Hello world.  

first column = ello; second column = ld.

Hello world.

UI Foramt: after date object is parsed, its possible to modify its display by using ';' separator and specifying the desired view format

timeDiff: specify time offset in milliseconds
locale: specify the locale in which the log was written
localeView: specify the locale in which the log should be displayed.

Also, see Optional Identifiers for Date Pattern section below.

Date in Log: 10/Jan/2013:11:32:38

18:05:23

18:05:23

{date,locale=it,dd MM yyyy HH:mm:ss}

{date,locale=it; localeView=en,dd MM yyyy}

Pattern to parse date:
{date:Date,dd/MMM/yyyy:HH:mm:ss}

Pattern with different display:
{date:Date,dd/MMM/yyyy:HH:mm:ss;yyyy-MM-dd HH:mm:ss}

{date,timeDiff=1000,HH:mm:ss}

{date,timeDiff=-5000,HH:mm:ss}

 
10/Jan/2013:11:32:38


2013-01-10 11:32:38

• 1388534400000
• 1414973208

• {timestamp,yyyy/MM/dd HH:mm:ss.SSS}  
• {timestamp,product=1000,yyyy-MM-dd HH:mm:ss.SSS}

•  2014/01/01 02:00:00.000
• 2014/11/03 02:06:48.000

Thread-1

Test 5 done 

calling to id 5667

 {string}-{number}

{string} {number} {string}

calling to id {number}

first column = Thread;second column = 1

first column = Test; second column = 5; third column = done

5667

 {choice,value1;value2...,valueN}

Note: All optional choices should appear as a semicolon separated list inside the tag.

 {geoip,type=country:region:city}

Note: All optional combinations of country, region and city are valid, for example: country:region, region:city, country etc.

66.249.71.162

193.35.249.128

{geoip:Remote Host,type=country:region:city}

{geoip:Remote Host,type=country}

66.249.71.162 United States CA Mountain View

193.35.249.128 United Kingdom

 {priority,priority1;priority2...,priorityN}

Note: All optional priorities should appear as a semi-colon separated list inside the tag.

 {expression}

Assuming you have two columns in your log, and you want to create a new column in your log view, represents a combining of these two records (highlighted in the example):

Mon Jul 10 04:33:51 2006 100 300

{date:Date,EEE MMM dd HH:mm:ss yyyy} {num:Num1} {num:Num2}{expression,Num2-Num1}

Mon Jul 10 04:33:51 2006 100 300 200

refIndex/refName (mandatory): the zero-based index of the source column / the name of the source column

columnType (mandatory for date/timestamp only):
columnType=timestamp;dateFormat=<the desired format of the date>
columnType=date;dateFormat=<the format of the date in the log to be extracted> 
dateUIFormat=<the format of the date desired to be displayed in XpoLog> 

multiLine (optional): indicates whether the record spreads over more than one line

expression (mandatory): the regular expression that will be extracted out of the value in the source column

See More Examples

keysSep (mandatory): the character/s that separate the key from the value

propSep (mandatory): the character/s that separate properties

Assuming you have the next record in your log:

2014-06-02 09:06:45,100 Type=INFO, Account=admin, ID=54, Team=all

No special attributes except date.If the date is inside the JSON object the following parameters may be specified:
#_#date::dateFormat=[THE_DATE_FORMAT_AS_APPEARS_IN_THE_DATA],dateUIFormat=[THE_DATE_FORMAT_AS_DESIRED_TO_BE_DISPLAYED_IN_XPOLOG]

Note: #_#date:: should be used as is as the separator between the date key name and the date parameters

Note: If one of the keys of a json is a json object then the full path from the top jason object should be speicfied using '->' to represent a level.

Assuming you have the next record in your log:

2014-11-24 12:02:32,083 {"red":"#f00", "green":"#0f0", "blue":"#00f", "yellow":"#ff0","black":"#000"}

Date usage example:
{"name":"x","hostname":"y","version":"z","time":"2017-07-01T00:00:00.000"}

JSON in JSON example:
{"name":"name","hostname":"hostname","pid":1,"level":1,"http details":{"URL":"http://xpolog.com","method":"GET"},"msg":"Message","time":"2017-11-01 00:00:00.000"}

{term,TERM}

TERM is the constant string

 {freetext,FREETEXT}

FREETEXT is the text that you wish to display in the log view.

 Multi-pattern:

{date,dd/MM/yyyy HH:mm:ss} {freetext,Dollar}$ {string}
{date,dd/MM/yyyy HH:mm:ss} {freetext,Percentage}% {string}

Note: The freetext tag does not replace any text in the pattern, therefore it could be placed anywhere in the pattern and should not be separated with a space.

{map,val1=convertedVal1;val2=convertedVal2;val3=convertedVal3;...;valN=convertedValN}

Using the following will convert the values as follows:

map:status,200=OK;304=Forbidden;404=Page Not Found;500=Internal Error Server}

{map,refIndex=ORIG_COL_INDEX,file:FULL_PATH_TO_FILE}

refIndex: numeric value which represents the index of the column in which its values will be converted (first column index is 0)

file:
Full path to the properties file that will be used to get the converted values 

Using the following will convert the values as follows:

{map,refIndex=8,file:C:\XpoLogConfig\HTTP_VALUES.txt}

• Index 8 is the index of the original column in the log which its values will be converted
• C:\XpoLogConfig\HTTP_VALUES.txt is the file containing the following:
  200=OK
  304=Forbidden
  404=Page Not Found
  500=Internal Error Server
• A new column will be created with the converted values

refIndex/refName (mandatory): the zero-based index of the source column / the name of the source column

columnType (mandatory)
  

mapping (mandatory)

expression (mandatory): the regular expression that will be extracted out of the value in the source column

Assuming you have the next record in your log, and you need to map the Logon Type (highlighted in the example) that is embedded in the message:

1400504701000*;*Microsoft-Windows-Security-Auditing*;*A logon was attempted using explicit credentials.

    Security ID:        S-1-0-0

    Logon ID:        0xdc01

    Logon Type: 3

first row = logger,db0
second row = logger,db1

01-25-1986  

{date,MM-dd-yyyy}

MMM - textual month

{string:Title}

{date:Start Date,dd/mm/yyyy}

{priority:Severity,DEBUG;INFO;ERROR}

{number:Status Code}