Skip to content

Commit

Permalink
This PR improves the regex example in the tail input plugin and in th…
Browse files Browse the repository at this point in the history
…e multiline filter example (#1241)

Signed-off-by: RicardoAAD <[email protected]>
  • Loading branch information
RicardoAAD authored Nov 7, 2023
1 parent 59491c8 commit fe1eaba
Show file tree
Hide file tree
Showing 2 changed files with 3 additions and 3 deletions.
2 changes: 1 addition & 1 deletion pipeline/filters/multiline-stacktrace.md
Original file line number Diff line number Diff line change
Expand Up @@ -110,7 +110,7 @@ This second file defines a multiline parser for the example. Note that a second
#
# rules | state name | regex pattern | next state
# ------|---------------|--------------------------------------------
rule "start_state" "/(Dec \d+ \d+\:\d+\:\d+)(.*)/" "cont"
rule "start_state" "/([A-Za-z]+ \d+ \d+\:\d+\:\d+)(.*)/" "cont"
rule "cont" "/^\s+at.*/" "cont"
```
Expand Down
4 changes: 2 additions & 2 deletions pipeline/inputs/tail.md
Original file line number Diff line number Diff line change
Expand Up @@ -178,7 +178,7 @@ In the case above we can use the following parser, that extracts the Time as `ti
[PARSER]
Name multiline
Format regex
Regex /(?<time>Dec \d+ \d+\:\d+\:\d+)(?<message>.*)/
Regex /(?<time>[A-Za-z]+ \d+ \d+\:\d+\:\d+)(?<message>.*)/
Time_Key time
Time_Format %b %d %H:%M:%S
```
Expand All @@ -190,7 +190,7 @@ If we want to further parse the entire event we can add additional parsers with
[PARSER]
Name multiline
Format regex
Regex /(?<time>Dec \d+ \d+\:\d+\:\d+)(?<message>.*)/
Regex /(?<time>[A-Za-z]+ \d+ \d+\:\d+\:\d+)(?<message>.*)/
Time_Key time
Time_Format %b %d %H:%M:%S
Expand Down

0 comments on commit fe1eaba

Please sign in to comment.