Apache Drill LogRegex plugin

Question

I'm trying to use Apache Drill with logFile Regex and I don't get configure it. I tried with the same example of the webpage https://drill.apache.org/docs/logfile-plugin/ but I got an error when I try to save it.

I have tried:

"log" : {
      "type" : "logRegex",
      "extension" : "log",
      "regex" : "(\\d{6})\\s(\\d{2}:\\d{2}:\\d{2})\\s+(\\d+)\\s(\\w+)\\s+(.+)",
      "maxErrors": 10,
      "schema": [
        {
          "fieldName": "eventDate",
          "fieldType": "DATE",
          "format": "yyMMdd"
        },
        {
          "fieldName": "eventTime",
          "fieldType": "TIME",
          "format": "HH:mm:ss"
        },
        {
          "fieldName": "PID",
          "fieldType": "INT"
        },
        {
          "fieldName": "action"
        },
        {
          "fieldName": "query"
        }
      ]
   }

It doesn't make too much sense to me, is I tried this too:

{
    "type": "file",
    "enabled": true,
    "connection": "file:///",
    "workspaces": {
      "root": {
        "location": "/user/max/donuts",
        "writable": false,
        "defaultInputFormat": null
       }
    },
    "formats" : {
      "json" : {
        "type" : "json"
      }
    },
"log" : {
      "type" : "logRegex",
      "extension" : "log",
      "regex" : "(\\d{6})\\s(\\d{2}:\\d{2}:\\d{2})\\s+(\\d+)\\s(\\w+)\\s+(.+)",
      "maxErrors": 10,
      "schema": [
        {
          "fieldName": "eventDate",
          "fieldType": "DATE",
          "format": "yyMMdd"
        },
        {
          "fieldName": "eventTime",
          "fieldType": "TIME",
          "format": "HH:mm:ss"
        },
        {
          "fieldName": "PID",
          "fieldType": "INT"
        },
        {
          "fieldName": "action"
        },
        {
          "fieldName": "query"
        }
      ]
   }
  }

Does anybody to config this plugin right?

Answer 1

Looks like your json-config file is not valid. Your "formats" key is closed right after after "json" format plugin. Please double check it or try this:

{
  "storage":{
    dfs: {
      type: "file",
      connection: "file:///",
      workspaces: {
        "root" : {
          location: "/",
          writable: false,
          allowAccessOutsideWorkspace: false
        },
        "tmp" : {
          location: "/tmp",
          writable: true,
          allowAccessOutsideWorkspace: false
        }
      },
      formats: {
        "log" : {
          "type" : "logRegex",
          "extension" : "log",
          "regex" : "(\\d{6})\\s(\\d{2}:\\d{2}:\\d{2})\\s+(\\d+)\\s(\\w+)\\s+(.+)",
          "maxErrors": 10,
          "schema": [
            {
              "fieldName": "eventDate",
              "fieldType": "DATE",
              "format": "yyMMdd"
            },
            {
              "fieldName": "eventTime",
              "fieldType": "TIME",
              "format": "HH:mm:ss"
            },
            {
              "fieldName": "PID",
              "fieldType": "INT"
            },
            {
              "fieldName": "action"
            },
            {
              "fieldName": "query"
            }
          ]
        }
      }
    }
  }
}