3

We are using LogMX log viewer to monitor our application logs, using a Regular Expression Parser.

Every time a log message contains the "-" character, LogMX doesn't parse the log event as expected.

For example, the following log event:

[ERROR] | com.nsoft.gmonitor.Controller - File Loader - Error while loading file "C:\GMonitor\prefs.properties - Copy"

Is parsed as:

  • Emitter: com.nsoft.gmonitor.Controller - File Loader

  • Thread: Error while loading file "C:\GMonitor\prefs.properties

  • Message: - Copy"

Instead of:

  • Emitter: com.nsoft.gmonitor.Controller

  • Thread: File Loader

  • Message: Error while loading file "C:\GMonitor\prefs.properties- Copy"

We are using the following regexp:

\[(.*)\] \| (.*) - (.*) - (.*)

Thank you for your help.

xav
  • 5,452
  • 7
  • 48
  • 57
ebatienss
  • 78
  • 4

2 Answers2

4

You should use this regexp instead:

\[(.*)\] \| (.*?) - (.*?) - (.*)

I just added a ? character after .* for 'Emitter' and 'Thread' fields/groups. This is a common regular-expression issue (not specific to LogMX):

  • .* is called a greedy quantifier: it means that it will try to match the maximum number of characters

  • .*? is called a reluctant quantifier: it means that it will try to match the minimum number of characters

You can read more about this in JDK API (search for 'greedy') or LogMX docs.

PS : if you don't want to use regular expressions to parse your logs in LogMX, you could use its "Log4j/Logback pattern Parsers" instead: the pattern [%p] | %c - %t - %m will match your need, and is reluctant by default for all fields/groups by default.

xav
  • 5,452
  • 7
  • 48
  • 57
2

That's because your regex is greedy. Try adding ? to your groups to avoid regex greedyness.

Take a look at this one:

\[.*\] .? (.*?) - (.*?) - (.*)

Regular expression visualization

Debuggex Demo

Here you can see the correct values stored on groups:

enter image description here

Federico Piazza
  • 30,085
  • 15
  • 87
  • 123