0

I'm creating log parser to parse the log message from different source like rsyslog, logback extension, nxlog etc.

I have to extract exception message fields. But I stuck while generating regex for below test string.

Test String:

2014-10-16 01:32:22,780 ERROR main Sample.main - java.lang.NullPointerException: Sample Log4j Exception
    at Sample.errorLevel3(Sample.java:35)
    at Sample.errorLevel2(Sample.java:31)
    at Sample.errorLevel1(Sample.java:27)
    at Sample.main(Sample.java:16)

Note: \n and \t are received as literal #012#011 in the string escaped by rsyslog

Expected Match:

2014-10-16 01:32:22,780
java.lang.NullPointerException
Sample Log4j Exception
----------
Sample.errorLevel3
Sample.java
35
----------
Sample.errorLevel2
Sample.java
31
----------
Sample.errorLevel1
Sample.java
27
Mariano
  • 6,423
  • 4
  • 31
  • 47
Amit
  • 47
  • 1
  • 11
  • In test string "#012#011" used as \r\n. Rsyslog converts new line to the code #012#011 – Amit Nov 10 '15 at 05:33
  • I found the regex for extracting java stack trace message field (?:\s+at ([^(]+)\(([^:]+):(\d+))\) It matches the field : Sample.errorLevel3 Sample.java 35 Sample.errorLevel2 Sample.java 31 Sample.errorLevel1 Sample.java 27 – Amit Nov 10 '15 at 05:37
  • #012 , #011 are octal code for char LF and TAB respectively. – Amit Nov 10 '15 at 05:42
  • Add `([-\d]+ [\d:,]+)` to the regex from [your previous question](http://stackoverflow.com/q/33565592/5290909). **[DEMO](https://regex101.com/r/fV9nM8/1)** – Mariano Nov 10 '15 at 05:44
  • Thanks @Mariano. I used rsyslog as log source. Rsyslog converts newline to octal code #012 #011 (LF, TAB). The actual log message is : `2014-10-16 01:32:22,780 ERROR main Sample.main - java.lang.NullPointerException: Sample Log4j Exception#012#011at Sample.errorLevel3(Sample.java:35)#012#011at Sample.errorLevel2(Sample.java:31)#012#011at Sample.errorLevel1(Sample.java:27)#012#011at Sample.main(Sample.java:16)#012` There are no new line in the log message. – Amit Nov 10 '15 at 06:10
  • You can either add the literal `#012#011` in the regex, or [read this post](http://stackoverflow.com/a/5544143/5290909) to disable it – Mariano Nov 10 '15 at 06:10
  • Thank you @Mariano for your effort. Now, Its work for me. – Amit Nov 10 '15 at 06:31
  • I'm glad it did! In case you decide to keep the escaped characters, here's the [full code](http://ideone.com/pdP4Xi) ... I'm also voting to close this question as duplicate of your previous post, as I think it involves the same criteria. – Mariano Nov 10 '15 at 06:37

0 Answers0