Substitution rule examples
Using the Positions, Match and Substitution fields
The following examples illustrate how to use the Positions, Match and Substitution fields
of a substitution rule.
- Substitution rule to retreive msg attribute value with separator token and designation token specified.
Log record:
<March 14, 2004 10:25:21 EST> application:myapp severity:3 instance:01 message:WARNING-file style.css missing
Rule specifications:
Separator Token= []{2}
Designation Token= :
Postions=$h('message')
Match=(.*)
Substitution=$1
Resulting value assigned to the msg atribute:
WARNING-file style.css missing
- Substitution rule to retreive msg attribute value with only separator token specified.
Log record:
<March 14, 2004 10:25:21 EST>;myapp;3;01;WARNING-file style.css missing
Rule specifications:
Separator Token=;
Designation Token=
Postions= 5
Match= (.*)
Substitution= $1
Resulting value assigned to the msg atribute:
WARNING-file style.css missing
- Substitution rule to retreive msg attribute value with only separator token specified.
Log record:
<March 14, 2004 10:25:21 EST>;myapp;3;01;WARNING;file style.css missing
Rule specifications:
Separator Token=;
Designation Token=
Postions= 5@@6
Match= (.*)@@(.*)
Substitution= $1-$2
Resulting value assigned to the msg atribute:
WARNING-file style.css missing
Using the Time Format field
The following examples illustrate how to use the Time Format field of a substitution rule.
- Substitution rule to retreive creationTime attribute value with no separator or designation token specified.
Log record:
<March 14, 2004 10:25:21 EST> myapp 3 01 WARNING file style.css missing
Rule specifications:
Separator Token=
Designation Token=
Postions=
Match= ^<(.*)>.*
Substitution= $1
Time Format= MMMM dd, yyyy hh:mm:ss z
Resulting value assigned to the creationTime atribute:
2004-03-14T15:25:21.000Z
Related tasks
Creating a log parser
Creating a rules-based adapter
Configuring the parser component
Creating a static adapter
Related references
Adapter Configuration file structure
Common Base Event format specification
Adapter Configuration Editor
Regular expression grammar
(C) Copyright IBM Corporation 2000, 2004. All Rights Reserved.