I want to read all log files from a folder for current date and find lines with "ERROR" string.
Create a table with columns as:
LogName, ErrorDescription
ErrorDescription should contain entire line which has Error Entry.
For Example:
2023.04.17D07:05:42 : ERROR : Failed to connect
Please help.
Question is vague but as example of how you might build it up:
List files in foler:
q)key `:myLogs
`s#`2023-04-17-process.log`2023-04-18-process.log
Only return .log files for today:
q){x where x like @[string[.z.d];4 7;:;"-"],"*.log"}key `:myLogs
,`2023-04-18-process.log
Read in the text from the files:
q)show each {{read0 .Q.dd[x;y]}[x] each {x where x like @[string[.z.d];4 7;:;"-"],"*"}key x}`:myLogs
"2023.04.17D07:05:42 : ERROR : Failed to connect"
"2023.04.17D07:05:42 : DEBUG : Failed to connect"
Split the text on " : ":
q)show each {{vs[" : "] each read0 .Q.dd[x;y]}[x] each {x where x like @[string[.z.d];4 7;:;"-"],"*"}key x}`:myLogs
"2023.04.17D07:05:42" "ERROR" "Failed to connect"
"2023.04.17D07:05:42" "DEBUG" "Failed to connect"
Create a table from the log fields:
q)raze {{{`time`level`msg!("P"$x 0;"S"$x 1;x)} each vs[" : "] each read0 .Q.dd[x;y]}[x] each {x where x like @[string[.z.d];4 7;:;"-"],"*"}key x}`:myLogs
time level msg
-------------------------------------------------------------------------------------
2023.04.17D07:05:42.000000000 ERROR "2023.04.17D07:05:42" "ERROR" "Failed to connect"
2023.04.17D07:05:42.000000000 DEBUG "2023.04.17D07:05:42" "DEBUG" "Failed to connect"
Only return ERROR level logs:
q){select from x where level=`ERROR}raze {{{`time`level`msg!("P"$x 0;"S"$x 1;x)} each vs[" : "] each read0 .Q.dd[x;y]}[x] each {x where x like @[string[.z.d];4 7;:;"-"],"*"}key x}`:myLogs
time level msg
-------------------------------------------------------------------------------------
2023.04.17D07:05:42.000000000 ERROR "2023.04.17D07:05:42" "ERROR" "Failed to connect"