4 Replies Latest reply: Jul 27, 2012 1:10 AM by Ferry Bolhar RSS

match_regex for a string

MRCK NameToUpdate

Hi,

I'm trying to extract three strings "uwsvr795" , "sanunix:"  & "I/O subsystem" from below event message using match_regex. I need to put those strings in new slots. I'm little stuck. Can someone help me?

 

Jul 19 08:27:09 uwsvr795 sanunix: errors from the I/O subsystem. I/O error entries will be lost

 

Thanks,

San

  • 1. Re: match_regex for a string
    Ferry Bolhar

    $RES = match_regex($str, "\w+ \d+ \d+:\d+:\d+ (\w+) (\w+): errors from the (.+)\./,"");

     

    Regards, Ferry

  • 2. Re: match_regex for a string
    MRCK NameToUpdate

    Thanks. Can you please check below rule. It's not compiling?

     

    refine io_error: NNM_EV($EV)

            where [ $EV.msg contains 'errors from the I/O subsystem' ]

                    {

                    $EV.mc_parameter_value = 'entries will be lost';

    if ( match_regex($EV.msg,'\w+ \d+ \d+:\d+:\d+ (\w+) (\w+): errors from the (.+)\./,[$PART1,$PART2,$PART3]) then {

                    $EV.msg = $PART1 || $PART2 || $PART3;

                   

            }

    END

     

    Thanks,

    San

  • 3. Re: match_regex for a string
    Oleg Protokolov

    Hi!

     

    Try this code...

     

    refine io_error: NNM_EV( $EV )

      where

      [

        $EV.msg contains 'errors from the I/O subsystem'

      ]

      {

        $EV.mc_parameter_value = 'entries will be lost';

        $FLDS = match_regex( $EV.msg, '\w+ \d+ \d+:\d+:\d+ (\w+) (\w+): errors from the (.+)\.', '' );

        if ( listlen( $FLDS ) == 3  ) then

        {

          $EV.msg = concat( $FLDS );

        };

      }

    END

     

    --

    Regards,

    Oleg

  • 4. Re: match_regex for a string
    Ferry Bolhar

    The result of match_regex has to be a single list variable, not a list of variables.

     

    Concerning my example, you can build the message string like this:

     

    $EV.msg = listgetelt($RES, 1) || "' " || listgetelt($RES, 2) || " " || listgetelt($RES, 3);

     

    or if you're running BEM 7.4 or higher:

     

    $EV.msg = listtostr($RES, " ");

     

    The example of OProtokolov concatenates the list elements without any additional separators which may not be what you've intended.