Regex to exclude certain error types from the log -
i relatively new need write regex exclude known error types log.
00:11:04 [0] 70-error: invalid index command: "/search.asp". 00:11:04 [0] 70-error: invalid index command: "/wingate-internal//boot.ini". 00:11:04 [0] 70-error: invalid index command: "/".
and exclude this:
04:16:46 [8] 70-error: action failed - unencrypted communication not allowed (10.40.88.11): "action=getstatus". 04:14:17 [7] 70-error: action failed - unencrypted communication not allowed (10.40.88.11): "action=getstatus".
i have other error types within same log fine reporting, example:
17:43:17.370 executerw: 957:error [2400] db matters - adddoctoworklist - dosqlcommand: error executing sql statement - cid ed83d1e0d
in other words, regex report on errors except 2 types mentioned above.
i tried creating regex doesn't seem work:
/(?:)(?:[^error\:\ action\ failed\ \-\ unencrypted\ communication\ is\ not\ allowed]*)(?:[^error\:\ invalid\ index\ command\:]*)/m
any appreciated.
how about:
^(?!.*error: invalid index command)(?!.*error: action failed - unencrypted communication not allowed)
explanation:
^ : begining of string (?! : negative lookahead (asserts following not present in string .* : 0 or more (*) character newline (.) error: invalid index command : literally ) : end of lookahead (?! : negative lookahead (asserts following not present in string .* : 0 or more (*) character newline (.) error: action failed - unencrypted communication not allowed : literally ) : end of lookahead
this regex matches lines not contain error: .........
in use in perl script:
#!/usr/bin/perl use modern::perl; $re1 = qr/^(?!.*error: invalid index command)(?!.*error: action failed - unencrypted communication not allowed)/; while(<data>) { print if /$re1/; } __data__ 17:43:17.370 executerw: 957:error [2400] db matters - adddoctoworklist - dosqlcommand: error executing sql statement - cid ed83d1e0d 00:11:04 [0] 70-error: invalid index command: "/search.asp". 17:43:17.370 executerw: 957:error [2400] db matters - adddoctoworklist - dosqlcommand: error executing sql statement - cid ed83d1e0d 00:11:04 [0] 70-error: invalid index command: "/wingate-internal//boot.ini". 17:43:17.370 executerw: 957:error [2400] db matters - adddoctoworklist - dosqlcommand: error executing sql statement - cid ed83d1e0d 00:11:04 [0] 70-error: invalid index command: "/". 17:43:17.370 executerw: 957:error [2400] db matters - adddoctoworklist - dosqlcommand: error executing sql statement - cid ed83d1e0d 04:16:46 [8] 70-error: action failed - unencrypted communication not allowed (10.40.88.11): "action=getstatus". 17:43:17.370 executerw: 957:error [2400] db matters - adddoctoworklist - dosqlcommand: error executing sql statement - cid ed83d1e0d 04:14:17 [7] 70-error: action failed - unencrypted communication not allowed (10.40.88.11): "action=getstatus". 17:43:17.370 executerw: 957:error [2400] db matters - adddoctoworklist - dosqlcommand: error executing sql statement - cid ed83d1e0d
output:
17:43:17.370 executerw: 957:error [2400] db matters - adddoctoworklist - dosqlcommand: error executing sql statement - cid ed83d1e0d 17:43:17.370 executerw: 957:error [2400] db matters - adddoctoworklist - dosqlcommand: error executing sql statement - cid ed83d1e0d 17:43:17.370 executerw: 957:error [2400] db matters - adddoctoworklist - dosqlcommand: error executing sql statement - cid ed83d1e0d 17:43:17.370 executerw: 957:error [2400] db matters - adddoctoworklist - dosqlcommand: error executing sql statement - cid ed83d1e0d 17:43:17.370 executerw: 957:error [2400] db matters - adddoctoworklist - dosqlcommand: error executing sql statement - cid ed83d1e0d 17:43:17.370 executerw: 957:error [2400] db matters - adddoctoworklist - dosqlcommand: error executing sql statement - cid ed83d1e0d
Comments
Post a Comment