I have some Tomcat Catalina data and I can't for the life of me figure out why it isn't line breaking properly. There are several different formats for the data going into the `catalina.out` files, so I have a rather complicated way to have to do the `props.conf` file. Here is a sample of the data that made it into a single event, but it needs to be broken up into individual events for each line (in this format):
12:50:59.524 [pool-4-thread-8046] DEBUG o.s.jdbc.core.JdbcTemplate - Executing SQL query [SELECT name, MAX(version) AS version FROM (SELECT sm.name, version, direction, crt_ts, ROW_NUMBER () OVER (PARTITION BY name, version ORDER BY crt_ts DESC) AS rn FROM schema_migrations sm) WHERE rn = 1 AND direction = 'FORWARD' GROUP BY name]
12:50:59.524 [pool-4-thread-8046] DEBUG o.s.jdbc.datasource.DataSourceUtils - Fetching JDBC Connection from DataSource
12:50:59.527 [pool-4-thread-8046] DEBUG o.s.jdbc.core.BeanPropertyRowMapper - Mapping column 'NAME' to property 'name' of type class java.lang.String
12:50:59.528 [pool-4-thread-8046] DEBUG o.s.jdbc.core.BeanPropertyRowMapper - Mapping column 'VERSION' to property 'version' of type class java.lang.Integer
12:50:59.528 [pool-4-thread-8046] DEBUG o.s.jdbc.datasource.DataSourceUtils - Returning JDBC Connection to DataSource
So there is no date, only a time in this case. The `props.conf` looks like this:
[tomcat_catalina]
SHOULD_LINEMERGE=true
NO_BINARY_CHECK=true
LINE_BREAKER=^(?:(?:\d{1,2}:\d\d:\d\d.\d\d\d\s+\[pool-)|(?:\[\w{1,7}\]\s\d\d\/\d\d\/\d\d\s)|(\w{3}\s+\d\d,\s\d{4}\s\d{1,2}:\d\d:\d\d\s[AP]M))
MAX_TIMESTAMP_LOOKAHEAD=200
TRUNCATE=999999
DATETIME_CONFIG = /etc/slave-apps/all_tomcat_props/local/datetime.xml
TIME_PREFIX = ^(\[\w{1,7}\]\s)?
The `datetime.xml` file looks like this:
(\d{1,2}):(\d{2}):(\d{2}).(\d{3}) (\d\d)/(\d\d)/(\d\d)\s+(\d\d):(\d\d):(\d\d)[:,.](\d\d\d) (\w{3})\s+(\d{1,2}),\s+(\d{4})\s+(\d{1,2}):(\d{2}):(\d{2})\s+(\w{2})
↧