Configuring the extractor component for a rules-based parser
Prerequisites:
In a rules-based log parser, the role of the extractor is to take a collection of
input lines provided by the sensor and separate
these into message boundaries. To configure the extractor, you need to first
determine the extractor class to use. Then, you can configure the Extractor rules based on the
selected extractor class.
Configuring the Extractor class
The default extractor class used is a regular expression
extractor. You can change the extractor class by modifying the Extractor component
in the Contexts section of the Adapter Configuration file.
- In the Adapter Configuration Editor, expand the node Contexts > Context Basic Context Implementation.
The Basic Context Implementation details are shown in the right pane.
- Select Component Regular Expression Extractor. The Extractor properties are displayed in the right
pane.

- Update the executable class to the class you want to use. For details, see the
Configuration file structure reference topic for the extractor classes provided by the Generic Log Adapter.
- Save the adapter configuration file changes.
Configuring the Extractor rules
Once you determine which extractor class to use, you can write corresponding rules for the
extractor in the context instance.
- In the left pane of the Adapter Configuration Editor, select Configuration > Context Instance > Extractor.
The right pane displays the extractor information.

- If the log file contains records that span multiple lines in the file, select
the Contains line breaks check box. Do not select this check box if each line in the
log file is a separate record or if there are no line breaks in the log file.
- If you want to replace the line breaks with an alternative symbol,
select Replace line breaks,
and type the symbol in the Line Break Symbol field.
Note: The side effect of using this option is that the values parsed from the log file will not contain line breaks unless explicitly added by the parser substitution rules.
- Write a script fragment in the Start Pattern field to identify
the start pattern. The default regular expression is the caret ^ symbol which is a null
token matching the beginning of a string or line.
- To include the start pattern in the result, check the Include Start Pattern
check box.
- Write a script fragment
in the End Pattern field to identify the end pattern. The
default regular expression is the dollar $ symbol which is a null
token matching the end of a string or line.
- To include the end pattern in the result, select the Include End Pattern
check box.
Hint: To help you with identifying the start and end patterns, click the Re-run icon
,
then click the Show log
icon. The log content that has been read by the sensor is shown in the Sensor Result view.
- Save the adapter configuration file to apply changes.
- To test your rules, click the Re-run adapter
icon to run the adapter. The results will be shown in the Extractor Result view.
Hint: You can specify the number of the record that you want to start viewing from. Use the drop down available from the Re-run adapter icon
and select Start from record. This will open up a dialog that allows you to specify a record number to start from.
- Click the Show Next Event
icon to see each of the log records that have been processed by the extractor rules you have written.
Hint: To change the number of result entries that are available for viewing
click on the Generic Log Adapter preferences icon
to launch the preferences page. Once the preferences page launches, update the buffer size.
For a detailed description of extractor properties, see the
Adapter Configuration File structure reference document.
The next step in creating a rule-based adapter is to configure the parser component.
Related concepts
Overview of the Hyades Generic Log Adapter
Related tasks
Configuring the parser component
Related references
Adapter Configuration File structure
Adapter Configuration Editor
Regular expression grammar
Limitations of the Adapter Configuration Editor
(C) Copyright IBM Corporation 2000, 2005. All Rights Reserved.