Define Log Entry Columns with Regular Expressions

The Columns Tab, found within both Log Consolidation and Log Monitor template properties views, enables you to extract values from log entries then, in the case of log consolidation, save those values to custom columns in your log repository database. Log Monitors use the column definitions to extract key value pairs before applying filters.

Event Log, Syslog and Text Log Consolidation and Monitor Templates all provide a list of Regular Expressions you can apply to extract the key value pairs.

To define regular expressions

• From the Regular Expressions List, click the Add button. A new line is added to the list.
• Use the Value Text Box to enter your regular expression.
• Use the Up Button and Down Button to reorder your regular expressions.

To define column definitions

See Define Log Entry Columns

Sample

If you apply the following regular expression to the above log entry, a key value pair is defined for each value in the log entry.

^(?<string_value>.*)\,(?<bool_value>.*)\,(?<byte_value>.*)\,(?<short_value>.*)\,(?<int_value>.*)\,(?<long_value>.*)\,(?<ushort_value>.*)\,(?<uint_value>.*)\,(?<ulong_value>.*)\,(?<datetime_value>.*)\,(?<timespan_value>.*)\,(?<float_value>.*)\,(?<double_value>.*)\,(?<decimal_value>.*)\,(?<level_value>.*)\,(?<fs_value>.*)\,(?<percent_value>.*)\,(?<gauge_value>.*)

To implement the above scenario define a column for each key value pair to extract. For example:

Related Topics

Define Log Entry Columns

Log Management Templates

Filters