Hello all,
I am trying to filter the data to be indexed however not success. Nothing is indexed.
I have the below log file:
< 2017-12-06 16:25:44.569 Script: Session started.
< 2017-12-06 16:25:44.569 Executing user defined command on command session.
> 2017-12-06 16:25:44.569 [Shell] df -gt /amb/local/sap_sd ; echo "WinSCP: this is end-of-file:$?"
< 2017-12-06 16:25:44.569 Script: Filesystem GB blocks Used Free %Used Mounted on
< 2017-12-06 16:25:44.569 [Shell] Filesystem GB blocks Used Free %Used Mounted on
< 2017-12-06 16:25:44.569 Script: /dev/lvsapsd 9.00 5.21 3.79 58% /amb/local/sap_sd
< 2017-12-06 16:25:44.569 [Shell] /dev/lvsapsd 9.00 5.21 3.79 58% /amb/local/sap_sd
< 2017-12-06 16:25:44.569 [Shell] WinSCP: this is end-of-file:0
> 2017-12-06 16:25:44.569 [Shell] pwd ; echo "WinSCP: this is end-of-file:$?"
And i just would like to index the lines that containing the word "lvsapsd " (4th and 5th lines).
I have configured my props.conf and transforms.conf as below:
[sourcetype]
TRANSFORMS-set= setnull,setparsing
[setnull]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue
[setparsing]
REGEX = .*(\blvsapsd\b).*/g
DEST_KEY = queue
FORMAT = indexQueue
Change your transforms.conf entry for setparsing with this (your don't have to match the whole line, specific keywords that can uniquely identify your events to keep will be sufficient)
[setparsing]
REGEX = lvsapsd
DEST_KEY = queue
FORMAT = indexQueue
Change your transforms.conf entry for setparsing with this (your don't have to match the whole line, specific keywords that can uniquely identify your events to keep will be sufficient)
[setparsing]
REGEX = lvsapsd
DEST_KEY = queue
FORMAT = indexQueue
Just another question...if I would like to include a phrase to be matched like "Script: Filesystem", how I can use in the regex expression?
REGEX = "Script: Filesystem" ?
Perfect!! Many thanks!!! 🙂