log parsing

[lindeamon]

hi,

how do i define several parameters to be passed in the <event>.
what will happen if i will write a variable name after the dot ?
for example:
<match>process:(.var)</match>
<event params="1">200000</event>

will the param name be "var" ?

10x,
lindeamon

[victor]

hi!

currently named parameters are not supported in the log parser. If you pass multiple parameters, they will be numbered in order they appear in regexp. For example, if you have the following rule:

<match>Error (.*) at (.*)</match>
<event params="2">200000</match>

You will have two parameters - number 1 and number 2, and it will be possible to use them in macro expansion as %1 and %2. For log record

Error 4 at test

with this rule you will have
%1 == "4"
%2 == "test"

Best regards,
Victor

[lindeamon]

thank you victor.
i have another 2 questions that came up my mind reading your answer.

1. can one xml file contain 2 <parser> sections ?
2. can the <event> contain two attributes meaning passing the two param ? something like this <event params="1","2"> or <event params="1",params="2">

10x,
lindeamon

[victor]

1. No. You should create separate xml file for each parser.
2. You can pass as many parameters as you like. Attribute params contains number of parameters, so if you have 4 parameters for the event, you will have <event params="4">. Of course you have to have appropriate number of capturing groups in regular expression.

Best regards,
Victor

[lindeamon]

thank you very much