6
responses

Hi

I'm using nxlog version 2.10.2102.

I have created the following Input:

<Input Test>
Module im_file
File "D:\\TEST\\Data\\posWS\\UploadLogs\\61\\\\*.*"
SavePos TRUE
<Exec>
if $raw_event =~ /[^,]+/g;\
{ \
$datetime = $1; \
$log_level = $2; \
$version = $3; \
$company_id = $4; \
$device_code = $5; \
$device_manufacturer = $6; \
$device_board = $7; \
$sdk_version = $8; \
$process_id = $9; \
$thread_id = $10; \
$class_name = $11; \
$method_name = $12; \
$file_name = $13; \
$line = $14; \
$description = $15; \
$stack_trace = $16; \
$EventTime = parsedate($datetime); \
$SourceName = "POS_Device"; \
}
delete($datetime);
</Exec>
</Input>

When I start the nxlog service, I receive the following error:

ERROR Couldn't parse Exec block at C:\Program Files (x86)\nxlog\conf\nxlog.conf:73; couldn't parse statement at line 74, character 29 in C:\Program Files (x86)\nxlog\conf\nxlog.conf; syntax error, unexpected ;, expecting (

I have tested the regex on https://regex101.com/ and it is working fine (flavour = pcre).

Sample data would be:

2018-07-19 10:26:07.830,ASSERT,3.0.2420InternalTest,145,352099091773370,samsung,universal7870,24,8521,1,CrashHandler,uncaughtException,CrashHandler.java,32,"UncaughtException","java.lang.NullPointerException: Attempt to invoke virtual method 'boolean bll.core.Product.isDiscountProduct()' on a null object reference;at bll.core.Sale$SaleItem.isDiscountItem(Sale.java:5514);at bll.core.Sale.containsSpecial(Sale.java:7685);at activity.SalesControlDisplaySale.setItemsPayments(SalesControlDisplaySale.java:454);at activity.SalesControlDisplaySale.displaySale(SalesControlDisplaySale.java:316);at activity.SalesControlDisplaySale.access$400(SalesControlDisplaySale.java:96);at activity.SalesControlDisplaySale$1.onItemSelected(SalesControlDisplaySale.java:213);at android.widget.AdapterView.fireOnSelected(AdapterView.java:1319);at android.widget.AdapterView.dispatchOnItemSelected(AdapterView.java:1308);at android.widget.AdapterView.-wrap1(AdapterView.java);at android.widget.AdapterView$SelectionNotifier.run(AdapterView.java:1275);at android.os.Handler.handleCallback(Handler.java:751);at android.os.Handler.dispatchMessage(Handler.java:95);at android.os.Looper.loop(Looper.java:154);at android.app.ActivityThread.main(ActivityThread.java:6776);at java.lang.reflect.Method.invoke(Native Method);at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:1496);at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:1386);"

If I do not use the "/g" (Global) at the end, it only returns the first match.

Any help would be greatly appropriated.

Many thanks

Stephen

AskedJuly 25, 2018 - 1:42pm

Answer (1)

It should be if $raw_event =~ /[^,]+/g without the semicolon ; at the end since it is not the end of the statement.

I suggest removing the newline escape characters \ if you are already using <Exec> blocks. This shouldn't affect anything but will make error reporting better.

The sample seems to be a multiline message which you may want to parse as such.

Comments (5)

  • stephen's picture

    Hi b0ti

    Thanks for feedback.

    I made the suggested change as follows:

    <Input Test>
    Module im_file
    File "D:\\TEST\\Data\\posWS\\UploadLogs\\61\\\\*.*"
    SavePos TRUE
    <Exec>
    if $raw_event =~ /[^,]+/g
    { \
    $datetime = $1; \
    $log_level = $2; \
    $version = $3; \
    $company_id = $4; \
    $device_code = $5; \
    $device_manufacturer = $6; \
    $device_board = $7; \
    $sdk_version = $8; \
    $process_id = $9; \
    $thread_id = $10; \
    $class_name = $11; \
    $method_name = $12; \
    $file_name = $13; \
    $line = $14; \
    $description = $15; \
    $stack_trace = $16; \
    $EventTime = parsedate($datetime); \
    $SourceName = "POS_Device"; \
    }
    delete($datetime);
    </Exec>
    </Input>

    But now I receive the following error:

    ERROR Couldn't parse Exec block at C:\Program Files (x86)\nxlog\conf\nxlog.conf:73; couldn't parse statement at line 75, character 3 in C:\Program Files (x86)\nxlog\conf\nxlog.conf; syntax error, unexpected {, expecting (

    Any ideas?

    Many thanks

    Stephen

  • Zhengshi's picture
    (NXLog)

    Try taking off the 'g' from the search string. I believe that is only needed/supported when doing substitutions.

    <Input Test>
        Module im_file
        File "D:\\TEST\\Data\\posWS\\UploadLogs\\61\\\\*.*"
        SavePos TRUE
        <Exec>
            if $raw_event =~ /[^,]+/
            { 
              $datetime = $1; 
              $log_level = $2; 
              $version = $3; 
              $company_id = $4; 
              $device_code = $5; 
              $device_manufacturer = $6; 
              $device_board = $7; 
              $sdk_version = $8; 
              $process_id = $9; 
              $thread_id = $10; 
              $class_name = $11; 
              $method_name = $12; 
              $file_name = $13; 
              $line = $14; 
              $description = $15; 
              $stack_trace = $16; 
              $EventTime = parsedate($datetime); 
              $SourceName = "POS_Device"; 
            }
            delete($datetime);
        </Exec>
    </Input>
    

  • stephen's picture

    Hi b0ti

    When testing this regex on https://regex101.com/ it is matching the different CSVs.

    These are only matches, should they be groups?

    Thanks

    Stephen