Export Log between 2 string | Log collection solutions

#1 RGO 6 years ago

Hi,

New to nxlog i don't even know where to search for that kind of needs...

SFB is a Microsoft UC client with several hundred Mo logs per day. I need to extract only a few information between strings for each PC. How can i achieve that ??

For Exp i need to extract this spécific info between those delimiters : <v3:Density>0.004195841</v3:Density>

Thanks for any help.

Permalink

#2 Zhengshi Nxlog ✓ 6 years ago

#1 RGO

Hi, New to nxlog i don't even know where to search for that kind of needs... SFB is a Microsoft UC client with several hundred Mo logs per day. I need to extract only a few information between strings for each PC. How can i achieve that ?? For Exp i need to extract this spécific info between those delimiters : <v3:Density>0.004195841</v3:Density> Thanks for any help.

Regex is your friend! There are many places in the manual that show this kind of work. Here for instance.

In this example we are rewriting the entire parsed $message with the results of what is between those tags. Capture groups are there so we can address them directly and only take what we want.

<Exec>
    if $raw_event =~ /(\<v3\:Density\>)(.*)(\<\/v3\:Density\>)/
    {
        $message = $2;
    }
</Exec>