SIEM, IPS, Server Monitoring, Uptime Monitoring and Compliance Software
Table of Contents

Define Log Entry Columns with Regular Expressions

The Columns Tab, found within both Log Consolidation and Log Monitor template properties views, enables you to extract values from log entries then, in the case of log consolidation, save those values to custom columns in your log repository database. Log Monitors use the column definitions to extract key value pairs before applying filters.

Event Log, Syslog and Text Log Consolidation and Monitor Templates all provide a list of Regular Expressions you can apply to extract the key value pairs.

To define regular expressions

  • From the Regular Expressions List, click the Add Add Button button. A new line is added to the list.
  • Use the Value Text Box to enter your regular expression.
  • Use the Up Button Up Button and Down Button Drop-Down Button to reorder your regular expressions.
    Information Multiple regular expressions enable you to test for different key value pairs. If the same key exists for multiple regular expression results, the last matching regular expression in the list is applied to the result set.

To define column definitions

See Define Log Entry Columns

Sample

Consider the following log entry:
My String,True,16,-1000,-100000,-10000000000,1000,100000,10000000000,2022-04-01,100,10.11,100.111,1000.1111,1,1024,50,75

If you apply the following regular expression to the above log entry, a key value pair is defined for each value in the log entry.

To implement the above scenario define a column for each key value pair to extract. For example: Regular Expressions Column Definitions Control

Related Topics

Define Log Entry Columns

Log Management Templates

Filters