|
|
| Line 95: |
Line 95: |
|
| |
|
| Please note that <nowiki><macros></nowiki> section always should be located before <nowiki><rules></nowiki> section in parser definition file. | | Please note that <nowiki><macros></nowiki> section always should be located before <nowiki><rules></nowiki> section in parser definition file. |
| | |
|
| |
|
| == Matching rules == | | == Matching rules == |
| <nowiki>In the <rules> section you define matching rules for log records. Each rule placed inside it's own <rule> tag. Each rule can have aditional options:</nowiki> | | In the <nowiki><rules></nowiki> section you define matching rules for log records. Each rule placed inside it's own <nowiki><rule></nowiki> tag. Each rule can have additional options: |
| | |
| | |
| | |
| {| style="border-spacing:0;"
| |
| | style="border-top:0.0007in solid #000000;border-bottom:0.0007in solid #000000;border-left:0.0007in solid #000000;border-right:none;padding:0.0382in;"| '''Option'''
| |
| | style="border-top:0.0007in solid #000000;border-bottom:0.0007in solid #000000;border-left:0.0007in solid #000000;border-right:none;padding:0.0382in;"| '''Description'''
| |
| | style="border:0.0007in solid #000000;padding:0.0382in;"| '''Default value'''
| |
|
| |
|
| | {| class="wikitable" |
| | |- |
| | ! Option !! Description !! Default value |
| |- | | |- |
| | style="border-top:none;border-bottom:0.0007in solid #000000;border-left:0.0007in solid #000000;border-right:none;padding:0.0382in;"| break
| | | break || If this option set to 1 and curent line match to regular expression in the rule, parser will stop processing of current line, even if global parser option '''processAll''' was set to 1. If this option set to 0 (which is by default), processing will stop according to '''processAll''' option settings. || 0 |
| | style="border-top:none;border-bottom:0.0007in solid #000000;border-left:0.0007in solid #000000;border-right:none;padding:0.0382in;"| If this option set to 1 and curent line match to regular expression in the rule, parser will stop processing of current line, even if global parser option '''processAll''' was set to 1. If this option set to 0 (which is by default), processing will stop according to '''processAll''' option settings. | |
| | style="border-top:none;border-bottom:0.0007in solid #000000;border-left:0.0007in solid #000000;border-right:0.0007in solid #000000;padding:0.0382in;"| 0 | |
| | |
| |- | | |- |
| | style="border-top:none;border-bottom:0.0007in solid #000000;border-left:0.0007in solid #000000;border-right:none;padding:0.0382in;"| context
| | | context || Name of the context this rule belongs to. If this option is set, rule will be processed only if given context was already activated with '''<nowiki><context></nowiki>''' tag in one of the rules processed earlier (it can be either same line or one of the previous lines). || ''empty'' |
| | style="border-top:none;border-bottom:0.0007in solid #000000;border-left:0.0007in solid #000000;border-right:none;padding:0.0382in;"| Name of the context this rule belongs to. If this option is set, rule will be processed only if given context was already activated with '''<nowiki><context></nowiki>''' tag in one of the rules processed earlier (it can be either same line or one of the previous lines). | | |} |
| | style="border-top:none;border-bottom:0.0007in solid #000000;border-left:0.0007in solid #000000;border-right:0.0007in solid #000000;padding:0.0382in;"| ''empty'' | |
|
| |
|
| |}
| | Inside the <nowiki><rule></nowiki> section are additional tags: <nowiki><match>, <description>, <event>, and <context></nowiki>. Only <nowiki><match></nowiki> section is mandatory – it specifies regular expression against which log record should be matched. All other tags are optional and defines parser behavior if record match regular expression. |
| <nowiki>Inside the <rule> section are additional tags: <match>, <description>, <event>, and <context>. Only <match> section are mandatory – it specifies regular expression against which log record should be matched. All other tags are optional and defines parser behavior if record match regular expression.</nowiki> | |
|
| |
|
|
| |
|
| Line 458: |
Line 450: |
| |} | | |} |
| Both '''action''' and '''reset''' attributes can be omited; default value for '''action''' is '''set''', and default value for '''reset''' is '''auto'''. | | Both '''action''' and '''reset''' attributes can be omited; default value for '''action''' is '''set''', and default value for '''reset''' is '''auto'''. |
|
| |
|
| |
|
| == Examples of Parser Definition File == | | == Examples of Parser Definition File == |