4 Replies Latest reply: Jul 27, 2012 1:10 AM by Ferry Bolhar RSS

    match_regex for a string

    MRCK NameToUpdate

      Hi,

      I'm trying to extract three strings "uwsvr795" , "sanunix:"  & "I/O subsystem" from below event message using match_regex. I need to put those strings in new slots. I'm little stuck. Can someone help me?

       

      Jul 19 08:27:09 uwsvr795 sanunix: errors from the I/O subsystem. I/O error entries will be lost

       

      Thanks,

      San

        • 1. Re: match_regex for a string
          Ferry Bolhar

          $RES = match_regex($str, "\w+ \d+ \d+:\d+:\d+ (\w+) (\w+): errors from the (.+)\./,"");

           

          Regards, Ferry

          • 2. Re: match_regex for a string
            MRCK NameToUpdate

            Thanks. Can you please check below rule. It's not compiling?

             

            refine io_error: NNM_EV($EV)

                    where [ $EV.msg contains 'errors from the I/O subsystem' ]

                            {

                            $EV.mc_parameter_value = 'entries will be lost';

            if ( match_regex($EV.msg,'\w+ \d+ \d+:\d+:\d+ (\w+) (\w+): errors from the (.+)\./,[$PART1,$PART2,$PART3]) then {

                            $EV.msg = $PART1 || $PART2 || $PART3;

                           

                    }

            END

             

            Thanks,

            San

            • 3. Re: match_regex for a string
              Oleg Protokolov

              Hi!

               

              Try this code...

               

              refine io_error: NNM_EV( $EV )

                where

                [

                  $EV.msg contains 'errors from the I/O subsystem'

                ]

                {

                  $EV.mc_parameter_value = 'entries will be lost';

                  $FLDS = match_regex( $EV.msg, '\w+ \d+ \d+:\d+:\d+ (\w+) (\w+): errors from the (.+)\.', '' );

                  if ( listlen( $FLDS ) == 3  ) then

                  {

                    $EV.msg = concat( $FLDS );

                  };

                }

              END

               

              --

              Regards,

              Oleg

              • 4. Re: match_regex for a string
                Ferry Bolhar

                The result of match_regex has to be a single list variable, not a list of variables.

                 

                Concerning my example, you can build the message string like this:

                 

                $EV.msg = listgetelt($RES, 1) || "' " || listgetelt($RES, 2) || " " || listgetelt($RES, 3);

                 

                or if you're running BEM 7.4 or higher:

                 

                $EV.msg = listtostr($RES, " ");

                 

                The example of OProtokolov concatenates the list elements without any additional separators which may not be what you've intended.