Substitution rule examples

Using the Positions, Match and Substitution fields

The following examples illustrate how to use the Positions, Match and Substitution fields of a substitution rule.

  1. Substitution rule to retreive msg attribute value with separator token and designation token specified.

    Log record:
    <March 14, 2004 10:25:21 EST> application:myapp severity:3 instance:01 message:WARNING-file style.css missing

    Rule specifications:
    Separator Token= []{2}
    Designation Token= :
    Postions=$h('message')
    Match=(.*)
    Substitution=$1


    Resulting value assigned to the msg atribute:
    WARNING-file style.css missing

  2. Substitution rule to retreive msg attribute value with only separator token specified.

    Log record:
    <March 14, 2004 10:25:21 EST>;myapp;3;01;WARNING-file style.css missing

    Rule specifications:
    Separator Token=;
    Designation Token=
    Postions= 5
    Match= (.*)
    Substitution= $1

    Resulting value assigned to the msg atribute:
    WARNING-file style.css missing

  3. Substitution rule to retreive msg attribute value with only separator token specified.

    Log record:
    <March 14, 2004 10:25:21 EST>;myapp;3;01;WARNING;file style.css missing

    Rule specifications:
    Separator Token=;
    Designation Token=
    Postions= 5@@6
    Match= (.*)@@(.*)
    Substitution= $1-$2


    Resulting value assigned to the msg atribute:
    WARNING-file style.css missing

Using the Time Format field

The following examples illustrate how to use the Time Format field of a substitution rule.

  1. Substitution rule to retreive creationTime attribute value with no separator or designation token specified.
    Log record:
    <March 14, 2004 10:25:21 EST> myapp 3 01 WARNING file style.css missing

    Rule specifications:
    Separator Token=
    Designation Token=
    Postions=
    Match= ^<(.*)>.*
    Substitution= $1
    Time Format= MMMM dd, yyyy hh:mm:ss z


    Resulting value assigned to the creationTime atribute:
    2004-03-14T15:25:21.000Z

Related tasks
Creating a log parser
Creating a rules-based adapter
Configuring the parser component
Creating a static adapter

Related references
Adapter Configuration file structure
Common Base Event format specification
Adapter Configuration Editor
Regular expression grammar