You can change the default separator that is
used to separate one or more attributes in a log file record.
When you create a log file attribute group, a separator
is by default assigned. The default separator is a tab. The separator
is used by the agent to parse and delimit the data for each attribute
in the data row. You can change the default attribute separator to
be:
- A fixed number of characters
- A space
- A different character or characters
- A specific beginning and end text
- An XML element.
You change the default separator that is used for all attributes
in the group in the following ways:
- When you are creating the attribute group, on the Log
File Information page.
- After you create the attribute group, by opening the tab,
selecting the attribute group and choosing a separator in the Field Identification area.
You can also optionally assign specific separators to
one or more individual attributes. You can assign specific separators
for individual attributes to use:
- A fixed number of characters.
- A tab separator
- A space separator
- A different character or characters
- A specific beginning and end text.
You change the separator that is used for individual attributes
in the following ways:
- By selecting Advanced on the Attribute Information page when you are creating an attribute.
- By opening the tab, selecting the attribute and selecting Advanced on the Log File Attribute Information tab.
Example 1 - Simple log file
output
Some log file records have clear and regular separators,
for example:
one,two,three
Here the
"," character is a clear and
regular separator between the three pieces of data on the row. In
this case, select
Separator Text and specify
"," as the default separator for the attribute group. There
is no need to change or define other separators.
Defining this
separator for a log file that contains the data row that is shown
earlier in this example is shown in the following output:
Figure 1. Example attribute value output
when Agent parses a simple log file data row.
Example 2 - Complex log file output
Some
log files can contain data rows that have irregular or changing separators,
for example:
one,two,three,[four]12:42,five
In this example an assignment of separators to attribute
definitions that you can use is:
- In the previous example you set the default separator
to ",". This separator is used for all attributes
unless you over-ride it with a specific separator. In this example
the default separator of "," is correct to use again
for the first three attributes in the row.
- For the fourth attribute, assume the string between the"[" and "]" is a value that you want to
extract. In this case when you define the fourth attribute, you assign
a separator type Begin and End Text with begin
and end text values of "[" and "]".
- For the fifth attribute, assume that you want to extract the values
between the "]" and ":" characters.
In this case when you define the fifth attribute, you assign separator
type Separator Text set to ":".
- For the sixth attribute, your default attribute group separator "," is fine again.
- For the seventh attribute, you do not need to specify a separator
as it is the last attribute.
Defining these separators on a log file that contains the data
row that is shown earlier in this example is shown in the following
output:
Figure 2. Example attribute
value output when Agent parses a complex log file data row.
The procedure to define the attribute separators is described
under step
5 of (
Monitoring a log file).