Splunk 中的正则表达式

发布于 2024-12-06 12:32:19 字数 924 浏览 4 评论 0原文

我需要正则表达式，它将为我提供以下格式的错误消息：

[2011-09-21 17:53:24:446 GMT][75DABF9052639D387C4E2F8EF7DC516C.http-8080-18]  [com.abc.resolver.rest.CommComponent] ERROR Cannot get payload while processing error message
[2011-09-21 17:53:24:446 GMT][75DABF9052639D387C4E2F8EF7DC516C.http-8080-18][com.pqr.chktest.Client] ERROR Error connecting to http://beta.com/api/1 with response code: 401
[2011-09-21 17:53:24:446 GMT][75DABF9052639D387C4E2F8EF7DC516C.http-8080-18][com.pqr.chktest.Client] ERROR upload error: java.lang.Exception: Error connecting to beta server at http address http://beta.com

处理时无法获取有效负载连接到 http://beta.com/api/1 时出错上传错误：连接时出错

基本上，我只想获取单词“ERROR”（大写字母）之后的前 5 个单词

“ERROR (?[^[]+)”正在返回整个单词。但我无法让它只处理前 5 个单词。

另外，如果 ERROR 之后的前 5 个单词包含 java.lang.Exception，我不想将其包含在结果中，而是需要下一个匹配的单词。

非常感谢任何帮助。

谢谢！

原文

I need regular expression which will provide me error msg in following format:

[2011-09-21 17:53:24:446 GMT][75DABF9052639D387C4E2F8EF7DC516C.http-8080-18]  [com.abc.resolver.rest.CommComponent] ERROR Cannot get payload while processing error message
[2011-09-21 17:53:24:446 GMT][75DABF9052639D387C4E2F8EF7DC516C.http-8080-18][com.pqr.chktest.Client] ERROR Error connecting to http://beta.com/api/1 with response code: 401
[2011-09-21 17:53:24:446 GMT][75DABF9052639D387C4E2F8EF7DC516C.http-8080-18][com.pqr.chktest.Client] ERROR upload error: java.lang.Exception: Error connecting to beta server at http address http://beta.com

Cannot get payload while processing
Error connecting to http://beta.com/api/1 with
upload error: Error connecting to

Basically, I want to get only first 5 words after word "ERROR" (in capital letter)

"ERROR (?[^[]+)" is returning me the whole words. But I'm not able to get it working for just first 5 words.

Also, if the first 5 words after ERROR contains java.lang.Exception, I don;t want to include it in my result, instead I need the next matching words.

Any help is much appreciated.

Thanks!

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

留一抹残留的笑 2024-12-13 12:32:19

尝试使用正则表达式

"ERROR(\s+[^\s]+){5}"

来获取“ERROR”后面的五个单词。对于第二部分（排除 java.lang.Exception ），我不会在单个正则表达式中执行此操作，而是测试第一个匹配项，如果它包含这些单词，则开始对字符串进行另一次搜索，现在就像

"java.lang.Exception:(\s+[^\s]+){5}"

Try the regular expression

"ERROR(\s+[^\s]+){5}"

to get five words after "ERROR". For the second part (exclude java.lang.Exception) I would not do it in a single regex but test the first match and if it includes these words start another search on the string, now like