expect regex to search a complete line or text - regex

my expect_output(buffer) is as below in multiple lines.
status QM1
QM(QM1) Status(Running)
CPU: 0.02%
Memory: 106MB
Queue manager file system: 391MB used, 47.3GB allocated
[1%]
HA role: Primary
HA status: Normal
HA control: Enabled
HA preferred location: Here
mqa(mqcli)#
tried multiple regex options, but i keep getting 0, as no match.
regexp /^.*\b(Running)\b.*$ $qmgrstat similar, get the value of "HA Status".
What would be the correct Regex syntax.

Not sure I understand. Do you only want to match the value of HA status? If yes, then this regex would do that:
HA status:\W*(.*)

If you want to capture the HA status when the "QM" status is Running, you can do
if {[string match {*Status(Running)*} $qmgrstat]} {
regexp {HA status:\s+(\S+)} $qmgrstat -> status
}

You can use the following regex to get the whole output:
status[^\v]*\vQM[^\v]*\vCPU:[^\v]*\vMemory:[^\v]*\vQueue manager file system:[^\v]*\vHA role:[^\v]*\vHA status:[^\v]*\vHA control:[^\v]*\vHA preferred location:[^\v]*\vmqa[^\v]*#\v
if you want the complete line of text with the status use: [^\v]*Status\([^\v]*
To get the line with the HA status you can use: HA status:[^\v]*
Good luck!

Related

Resource Regex Cause Panic

This code is an attempt to replace a service that already works in production, written in java, with one written in rust.
This service will serve as a sidecar proxy for a redis cluster, exposing an api rest. It needs to maintain compatibility with the current api.
The Route is:
"/api/keys/{path:*}"
In path we can put de name of the key for redis, and can contain any format below:
/api/keys/users/41728391
/api/keys/users/1000/followers
/api/keys/users/{1234}/data
this is my attempt
HttpServer::new(move || App::new()
.data(redis_config)
.service(
web::resource("/set/{path:*}").route(web::put().to(set_key))
) ).bind(("127.0.0.1", 8080))?
.run()
.await
I tried like this too:
#[get("/set/{path:*}")]...
But in two cases i get this error:
.service(web::resource("/set/{path:*}").route(web::put().to(path_regex)))
| ^^^^^^^^^^ the trait `Factory<_, _, _>` is not implemented for `path_regex`
thread 'thread 'actix-rt:worker:1actix-rt:worker:0' panicked at '' panicked at 'Wrong path pattern: "/set/{path:*}" regex parse error:
^/set/(?P<path>*)$
^
error: repetition operator missing expressionWrong path pattern: "/set/{path:*}" regex parse error:
^/set/(?P<path>*)$
^
I have read the https://actix.rs/actix-web/actix_web/web/fn.resource.html
My code is : https://github.com/rogeriob2br/enge-sidecar-redis

zabbix vfs.file.regmatch regex

I'm new to zabbix. I need to monitor the log file and create a warning if its content doesn't meet the following:
{ "10.0.0.1": "0" }
I tried to use vfs.file.regmatch for this and with following regexes:
vfs.file.regmatch[/tmp/test72.log,'\{ \"10\.0\.0\.1\"\: \"0\" \}']
vfs.file.regmatch[/tmp/test72.log,‘{ "10.0.0.1": "0"}’]
But all of them returns 0 (False), when I check in zabbix web interface, but trying to run in shell I get the following (expected result):
zabbix_agentd -t vfs.file.regmatch[/tmp/test72.log,'{ "10.0.0.1": "0" }']
vfs.file.regmatch[/tmp/test72.log,{ "10.0.0.1": "0" }] [u|1]
Have I missed some escape characters?
ALso, my Zabbix server and agents versions are 3.4.15.
Thanks in advance!

Too many parts after spliting with regexes

I'm trying to parse some logs using split and regexes in powershell
Here's my code :
$string = "Starting ChromeDriver 78.0.3904.70Please protect ports used by ChromeDriver and related test frameworks to prevent access by malicious code. Test 229: Passed Test 260: Failed. Error message: Status: Test case failed. Steps: Navigate to: PurchReqTableListPage (purchreqpreparedbyme) Use the Quick Filter to find records. For example, filter on the Purchase requisition fION()</StackTrace> </Error> Playback results: Tests: 2 Passed: 1 Failed: 1"
$string -Split '(Test (\d)+:)'
Result :
Starting ChromeDriver 78.0.3904.70Please protect ports used by ChromeDriver and related test frameworks to prevent access by malicious code.
Test 229:
9
Passed
Test 260:
0
Failed. Error message: Status: Test case failed. Steps: Navigate to: PurchReqTableListPage (purchreqpreparedbyme) Use the Quick Filter to find records. For example, filter on the Purchase requisition fION()</StackTrace> </Error> Playback results: Tests: 2 Passed: 1 Failed: 1
Expected result:
Starting ChromeDriver 78.0.3904.70Please protect ports used by ChromeDriver and related test frameworks to prevent access by malicious code.
Test 229:
Passed
Test 260:
Failed. Error message: Status: Test case failed. Steps: Navigate to: PurchReqTableListPage (purchreqpreparedbyme) Use the Quick Filter to find records. For example, filter on the Purchase requisition fION()</StackTrace> </Error> Playback results: Tests: 2 Passed: 1 Failed: 1
On this site : https://regexr.com/3c0lf I tried this regex and the groups captured were : Test 260: and Test 229: (which is exactly what I want)
I do not understand where the 0 and the 9 comes from.
Thanks a lot
Those are the last digits of the number. 0 from 26*0* and 9 from 22*9*.
You are seeing those because you've created an additional capturing group by putting parentheses around the digits. Just remove them like so:
$string -Split '(Test \d+:)
You probably don't even need those parentheses either, leaving just
$string -Split 'Test \d+:

Logstash pattern matching more than it should

I have a log line (multiline match) that looks like the following:
3574874 14/Jul/2016 20:42:37 +0000 ERROR [http-bio-0.0.0.0-8443-exec-128] error_jsp _jspService > could not lock: [com.myCompany.myProject.bean.scheduling.Area#6306]; SQL [/* UPGRADE lock com.myCompany.myProject.bean.scheduling.Area */ select Area_id from Area_ID where Area_id =? and Area_Version =? for update]; nested exception is org.hibernate.exception.LockAcquisitionException: could not lock: [com.myCompany.myProject.bean.scheduling.Area#6306]
org.springframework.dao.CannotAcquireLockException: could not lock: [com.myCompany.myProject.bean.scheduling.MyClass#6306]; SQL [/* UPGRADE lock com.myCompany.myProject.bean.scheduling.MyClass */ select Area_ID from Area where Area =? and Area =? for update]; nested exception is org.hibernate.exception.LockAcquisitionException: could not lock: [com.myCompany.myProject.bean.scheduling.Area#6306]
at org.springframework.orm.hibernate3.SessionFactoryUtils.convertHibernateAccessException(SessionFactoryUtils.java:639)
at org.springframework.orm.hibernate3.HibernateExceptionTranslator.convertHibernateAccessException(HibernateExceptionTranslator.java:89)
at org.springframework.orm.hibernate3.HibernateExceptionTranslator.translateExceptionIfPossible(HibernateExceptionTranslator.java:68)
at org.springframework.dao.support.ChainedPersistenceExceptionTranslator.translateExceptionIfPossible(ChainedPersistenceExceptionTranslator.java:58)
at org.springframework.dao.support.DataAccessUtils.translateIfNecessary(DataAccessUtils.java:213)
at org.springframework.dao.support.PersistenceExceptionTranslationInterceptor.invoke(PersistenceExceptionTranslationInterceptor.java:163)
at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172)
at org.springframework.aop.framework.CglibAopProxy$DynamicAdvisedInterceptor.intercept(CglibAopProxy.java:633)
at com.myCompany.myProject.dal.hibernate.Impl$$EnhancerBySpringCGLIB$$535be625.lock(<generated>)
at com.myCompany.myProject.scheduling.Area.AreaClose(MyClass.java:1265)
at com.myCompany.myProject.scheduling.Area.handleProviderDisconnect(MyClass.java:1190)
at com.myCompany.myProject.scheduling.Area$$FastClassBySpringCGLIB$$220c3d67.invoke(<generated>)
at org.springframework.cglib.proxy.MethodProxy.invoke(MethodProxy.java:204)
at org.springframework.aop.framework.CglibAopProxy$CglibMethodInvocation.invokeJoinpoint(CglibAopProxy.java:700)
My pattern file lays things out like this:
# AW Tomcat formatting
TOMCAT_DATE %{MONTHDAY}[./-]%{MONTH}[./-]%{YEAR}
TOMCAT_TS %{BASE10NUM}
#%{BASE10NUM}
TOMCAT_TIME %{HOUR}:%{MINUTE}(?::%{SECOND})(?![0-9])
TOMCAT_THREAD \[(.+?)\]
TOMCAT_CLASS [A-Za-z0-9]+
TOMCAT_CLASS_METHOD %{NOTSPACE}
TOMCAT_TIMESTAMP %{TOMCAT_DATE}[\s]+%{TOMCAT_TIME}
TOMCAT_MESSAGE .+
TOMCAT_IP %{IP}
TOMCAT_DATA %{NOTSPACE}
TOMCAT_LOG (?:%{TOMCAT_TS:log_ts})[\s]+(?:%{TOMCAT_TIMESTAMP:log_timestamp})[\s]+%{INT}[\s]+(?:%{LOGLEVEL:log_level})[\s]+(?:%{TOMCAT_THREAD:thread})[\s]+(?:%{TOMCAT_CLASS:class_name})[\s]$
When I look at this in logstash it seems like the code for thread is matching a lot more than just the thread... it's matching all the way to [com.myCompany.myProject.bean.scheduling.MyClass#6306];
When I take JUST the thread and the regex for space after and toss it on regexr or regex101 I can't recreate this using:
\[(.+?)\][\s]+
Does anyone have insight on why the regex is working everywhere but logstash? Also, this works on about 99.5% of my incoming tomcat logs as well....
You have a + in your log. You need to match it with \+ or make it optional with \+?:
TOMCAT_LOG (?:%{TOMCAT_TS:log_ts})\s+(?:%{TOMCAT_TIMESTAMP:log_timestamp})\s+\+?%{INT}\s+(?:%{LOGLEVEL:log_level})\s+(?:%{TOMCAT_THREAD:thread})\s+(?:%{TOMCAT_CLASS:class_name})\s*$
^^^

grok regex parsing not matching a log. when specifying a group as optional, but not the last group

Example:
info: 2014-10-28T22:39:46.593Z - info: an error occurred while trying
to handle command: PlaceMarketOrderCommand, xkkdAAGRIl. Error:
Insufficient Cash #userId=5 #orderId=Y5545
pattern:
> %{LOGLEVEL:stream_level}: %{TIMESTAMP_ISO8601:timestamp} -
> %{LOGLEVEL:log_level}: %{MESSAGE:message}
> (#userId=%{USER_ID:user_id})? (#orderId=%{ORDER_ID:order_id})?
extra patterns used:
USER_ID (\d+|None)
ORDER_ID .*
ORDER_ID_HASH \s*(#orderId=%{ORDER_ID:order_id})?
USER_ID_HASH \s*(#userId=%{USER_ID:user_id})?
MESSAGE (.*?)
Works fine:
removing the optional last orderId also works
info: 2014-10-28T22:39:46.593Z - info: an error occurred while trying
to handle command: PlaceMarketOrderCommand, xkkdAAGRIl. Error:
Insufficient Cash #userId=5
but if I keep the orderId and remove the userId then I get a "no match"
info: 2014-10-28T22:39:46.593Z - info: an error occurred while trying
to handle command: PlaceMarketOrderCommand, xkkdAAGRIl. Error:
Insufficient Cash #orderId=Y5545
Also the user_id group is ending with a ? as an optional group..
working with the grok debugger in heroku:
Is this a bug? (logstash 1.4.2) missing something with the regex? (more probable.. but what?)
I looked at the regex lib grok is using and looks this syntax supposed to work. It does work for the last group (orderId) but not for the one before..
Thanks for the help!
You are forcing a space to be before your optional last... you need to do ?:
%{LOGLEVEL:stream_level}: %{TIMESTAMP_ISO8601:timestamp} -> %{LOGLEVEL:log_level}: %{MESSAGE:message} ?(#userId=%{USER_ID:user_id})? ?(#orderId=%{ORDER_ID:order_id})?