CODEWITHSUNDEEP
regexlogparserlog-viewerlogmx
ebatienss
ebatienss

Reputation: 78

Issue with LogMX Regular Expression Parser

We are using LogMX log viewer to monitor our application logs, using a Regular Expression Parser.

Every time a log message contains the "-" character, LogMX doesn't parse the log event as expected.

For example, the following log event:

[ERROR] | com.nsoft.gmonitor.Controller - File Loader - Error while loading file "C:\GMonitor\prefs.properties - Copy"

Is parsed as:

Instead of:

We are using the following regexp:

\[(.*)\] \| (.*) - (.*) - (.*)

Thank you for your help.

Upvotes: 3

Views: 850

Answers (2)

xav
xav

Reputation: 5628

You should use this regexp instead:

\[(.*)\] \| (.*?) - (.*?) - (.*)

I just added a ? character after .* for 'Emitter' and 'Thread' fields/groups. This is a common regular-expression issue (not specific to LogMX):

  • .* is called a greedy quantifier: it means that it will try to match the maximum number of characters

  • .*? is called a reluctant quantifier: it means that it will try to match the minimum number of characters

You can read more about this in JDK API (search for 'greedy') or LogMX docs.

PS : if you don't want to use regular expressions to parse your logs in LogMX, you could use its "Log4j/Logback pattern Parsers" instead: the pattern [%p] | %c - %t - %m will match your need, and is reluctant by default for all fields/groups by default.

Upvotes: 4

Federico Piazza
Federico Piazza

Reputation: 31035

That's because your regex is greedy. Try adding ? to your groups to avoid regex greedyness.

Take a look at this one:

\[.*\] .? (.*?) - (.*?) - (.*)

Regular expression visualization

Debuggex Demo

Here you can see the correct values stored on groups:

enter image description here

Upvotes: 2

Related Questions