Log parsing rules

Log parsing rules provide you the ability to parse, extract, map, convert and filter your log entries. Rules can help you convert unstructured log data into JSON format, extract important information from your logs and filter your log stream according to various conditions.

One of the most popular ways to customize your logs is using named groups Regex. This will allow you to modify and extract your logs in various ways For more information on named groups Regex

Access your log parsing rules interface here: Coralogix parsing rules interface, and then:

  1. add a new group
  2. Name your group
  3. Add a new rule
  4. Approve the rule you created (note that you can see how it affects your data in real time)

Here are 2 examples on how you can leverage this feature:

PConvert log message to JSON

Raw log:

result: 200, status: OK, username: anonymous
Define parse rule:

^result:\s(?P<result>\d+),\sstatus:\s(?P<status>[^,]+),\susername:\s(?P<username>.*)

Result:

{
  "result" : 200,
  "status" : 'OK',
  "username" : "anonymous"
}

Extract information from log message

Raw log:

INFO - myclass: This is a test message
Define parse rule:

(?P&lt;severity&gt;[^ ]+)\s-\s(?P&lt;category&gt;[^:]+):\s(?P&lt;text&gt;.*)

The result is the “INFO” value will be extracted to severity column, “myclass” to category column and the rest will go to the text column.

Signup to Coralogix
WordPress Lightbox