0

I have a log like this:

14:40:33.476 [WebContainer : 149] sometihng sometihng 
14:40:33.476 [WebContainer : 149] sometihng sometihng 
14:40:33.476 [WebContainer : 149] sometihng sometihng 
14:40:33.476 [WebContainer : 245] csometihng sometihng 
14:40:33.476 [WebContainer : 245] sometihng sometihng 
14:40:33.476 [WebContainer : 245] sometihng sometihng

I use nxlog to send this to kafka, what I want is to merge all lines with "WebContainer : 149" into one, and next line when this changes and so on.

madi
  • 160
  • 1
  • 13

1 Answers1

1

You can use the following regex to capture all the lines with a certain value:

/(.*\[WebContainer : (\d+)\]\s*(.*))+\s+.*\[WebContainer : \2\]\s(.*)+\s+.*\[WebContainer : \2\]\s(.*)+/g

The regex matches any number of any char up to '[WebContainer : ', then matches any number and a right Square bracket before matcing White Spaces.

Then it starts all over Again (a new line), only here it uses capturing Group 2 to specify the number. This is repeated on the third line.

Then replace the matches with :

$1$3$4

Now you will get one line per number, combining the 'sometihng' from each line.

Poul Bak
  • 10,450
  • 5
  • 32
  • 57
  • This works for this particular case, but what if we don't know how many lines will the webcontainer: 123 will have (but a finite number). And forget about this something:) – madi Nov 22 '18 at 14:46
  • You can't add an unknown number of lines. Then it becomes multiple matches and can't be replaced with back references. – Poul Bak Nov 22 '18 at 14:50
  • If you want to add one line, you can add '\s+.*\[WebContainer : \2\]\s(.*)+' to the regex and '$5' to the replacement. – Poul Bak Nov 22 '18 at 14:51