Search code examples
log4japache-chainsaw

Chainsaw log format pattern syntax

We have a log4j file that has the following pattern:

@|%d{yyyy-MM-dd HH:mm:ss.SSS}|%X{Machine}|%X{CorrelationId}|%X{Sender}|%X{Receiver}|%-5p|%X{Runtime}|%X{ClientUser}|%c|%M|%L|%m%n

I created a LogFilePatternReceiver with the following pattern:

@|TIMESTAMP|PROP(MACHINE)|PROP(CORRELATIONID)|PROP(SENDER)|PROP(RECEIVER)|LEVEL|PROP(RUNTIME)|PROP(CLIENTUSER)|CLASS|METHOD|LINE|MESSAGE

But when I start that receiver I get an error:

java.lang.IllegalArgumentException: invalid expression: 
    at org.apache.log4j.rule.ExpressionRule$PostFixExpressionCompiler.compileExpression(ExpressionRule.java:132)
    at org.apache.log4j.rule.ExpressionRule.getRule(ExpressionRule.java:64)
    at org.apache.log4j.rule.ExpressionRule.getRule(ExpressionRule.java:56)
    at org.apache.log4j.varia.LogFilePatternReceiver.initialize(LogFilePatternReceiver.java:557)
    at org.apache.log4j.varia.LogFilePatternReceiver$1.run(LogFilePatternReceiver.java:801)
    at java.lang.Thread.run(Unknown Source)

regexp is @|(\w+-\w+-\w+ \w+:\w+:\w+.\w+)|(.+?)|(.+?)|(.+?)|(.+?)|(.+?)|(.+?)|(.+?)|(.+?)|(.+?)|(.+?)|(.+)

I don't really see where the error is? Any input? Can I use the "PROP(...)" keyword like that for columns that are non-standard?

Solution

  • Yes, you can use the PROP keyword for your own columns..

    Can you try the latest developer snapshot of Chainsaw? It can parse your log4j.xml or log4j.properties configuration containing FileAppender entries and will build a matching Chainsaw config to process that.

    Snapshot available here..the new version also has a lot of new features:

    http://people.apache.org/~sdeboy

    What usually trips people up is timestamp formatting and special characters, but I don't see anything weird here, so see if the latest developer snapshot helps.

    Scott