1

I have single line like

sgcib.solstis.core.dao.referential.InsertionMonitoringDao:10:37:36.860 [SOLSTAIRJVM1: customService :false-persistor-3-] INFO Begin updating insertion_monitoring table: analysisProcessId=1000000648897, insertionMonitorId=9153700, binFileName=TIS_MRM_Meteor_DeltaSpot_RA_SMCPLX_47769.2x2.2016-11-29-00-00-00_1480377600000.bin.tisdevweb043.SOLSTAIRJVM1

Here, extract value [SOLSTAIRJVM1: customService :false-persistor-3-] as thread field AND 1000000648897 as one analysisProcessId field and 9153700 as another insertionMonitorId field.And fields values are optional in the input line,incase not found in input line fields must be shown with empty value.

Can any one please suggest how to write pattern?

Nagappa L M
  • 1,452
  • 4
  • 20
  • 33

1 Answers1

1

You may use

\[(?<thread>[^\]\[]*)].*?analysisProcessId=(?<analysisProcessId>\d+).*?insertionMonitorId=(?<insertionMonitorId>\d+)

Description:

  • \[ - a literal [
  • (?<thread>[^\]\[]*) -
  • ].*? - a literal ] followed with any 0+ chars other than line break chars as few as possible up to the first
  • analysisProcessId= - a analysisProcessId= substring
  • (?<analysisProcessId>\d+) - Group "analysisProcessId" capturing 1+ digits
  • .*?insertionMonitorId= - any 0+ chars other than line break chars as few as possible up to and incl. the first insertionMonitorId=
  • `(?\d+) - Group "insertionMonitorId" capturing 1+ digits

See the demo screen:

enter image description here

Wiktor Stribiżew
  • 607,720
  • 39
  • 448
  • 563
  • Could you suggest along with extracting the fields.How to take original exact line as another field ? – Nagappa L M Dec 22 '16 at 13:32
  • Do you mean the whole string should be a field by itself? Something like [`^(?.*?\[(?[^\]\[]*)].*?analysisProcessId=(?\d+).*?insertionMonitorId=(?\d+).*)`](https://regex101.com/r/UNk06w/3). – Wiktor Stribiżew Dec 22 '16 at 13:35
  • Thank you very much – Nagappa L M Dec 22 '16 at 14:01
  • For example for given input "anystring [anystring1] IN" if the pattern is .*?(?\[.*\]) here thread_name field value is anystring1 .I want if [anystring1] does not exist then value of thread_name to "".what is going to be the new pattern ? – Nagappa L M Dec 23 '16 at 08:42
  • Hey hi you are back thanks [anystring1] is not extracted as field value using (?(?:\[.*\])?).Sorry i have used (?\[.*\]) not .*?(?[.*]) – Nagappa L M Dec 23 '16 at 10:42
  • Is the `[anystring1]` always at the end of the string? If yes, `(?(?:\[.*\])?)$` should work. – Wiktor Stribiżew Dec 23 '16 at 10:43
  • Thanks.[anystring1] may not be at the end of string always. – Nagappa L M Dec 23 '16 at 10:47
  • Ok, then use `(?:(?!\[[^\]\[]*\]).)*(?(?:\[[^\]\[]*\])?)` – Wiktor Stribiżew Dec 23 '16 at 10:49
  • Ohh thank you very much.It works.Looks you added many changes.It is getting difficult to analyse for me. Similarly how can make all fields value to empty if pattern not exist in the input line for the below .*?(?\[.*\]).*?(analysisProcessId=)*(?\d*).*?insertionMonitorId=(?\d*).*?binFileName=*(?.*.bin*) Please help me i do analyse later to have much understanding – Nagappa L M Dec 23 '16 at 10:54
  • By the way i have used input line "sgcib.solstis.core.dao.referential.InsertionMonitoringDao:10:37:36.860 [SOLSTAIRJVM1: customService :false-persistor-3-] INFO Begin updating insertion_monitoring table: analysisProcessId=1000000648897, insertionMonitorId=9153700, binFileName=TIS_MRM_Meteor_DeltaSpot_RA_SMCPLX_47769.2x2.2016-11-29-00-00-00_1480377600000.bin.tisdevweb043.SOLSTAIRJVM1" – Nagappa L M Dec 23 '16 at 10:55
  • You will be able to do that all by yourself after learning the [tempered greedy token](http://stackoverflow.com/a/37343088/3832970). Replace all `.*?` with the corresponding TGT. – Wiktor Stribiżew Dec 23 '16 at 10:56
  • Thanks for the motivation – Nagappa L M Dec 23 '16 at 11:03
  • Hey sorry for reping i could see [anystring1] as field value but need anystring1 as value how to avoid [ and ] in value ? – Nagappa L M Dec 23 '16 at 11:22
  • Put the `[` and `]` outside the capturing group. `\[(?[^\]\[]*)\]`. If it is optional, wrap with `(\[(?[^\]\[]*)\])?` – Wiktor Stribiżew Dec 23 '16 at 12:13
  • Hi can you please help me on http://stackoverflow.com/questions/41426198/extracting-many-optional-comma-separated-fields-using-grok-pattern Not getting how to take pattern that ends with , – Nagappa L M Jan 03 '17 at 12:32