Ryan209
3 discussion posts
I'd like to highlight errors when looking at a windows event log, but the string "Error" also appears in many non-Error level messages.
I haven't found any help documentation on what the regular expression syntax is for highlighting, but if columns' strings were each compared separately to the regex, then using "^Error$" would work for me in most cases. Since that doesn't work I assume you concatenate the record into a single string before comparing? It looks like you are concatenating using space as the delimiter. If you changed to concatenate with some (carefully chosen) special character then we could use a regex with that special character to select by field like "\|Error\|".
You're correct, right now, LogFusion can only highlight/filter based on the whole line, not specific columns. We do have an open feature request for per-column filtering/highlighting though, so I've added your vote.
In the meantime, if you set your highlight Rule to this, it should only highlight lines where Error is next to the time (include the quotes as well):
"AM Error" "PM Error"
Ryan209
3 discussion posts
That doesn't work for me. It looks like that concept works in general, but that the Date is not in the record stringification so it cannot be matched against.
Oh really? That's interesting... can you send me a sample log line from your event log?
Ryan209
3 discussion posts
Here is a slightly redacted line from right-clicking a line of the log in LogViewer and selecting "Copy Selected Rows":
6/29/2017 11:51:46 AM Warning Foo Controller rb1\Ryan 0 The redacted message.
None of the rules "AM Warning", "AM", "2017" nor "46" select this line in LogViewer.
The rules "Warning", "Controller", and "rb1" do select this line.
I have only one rule enabled to avoid any conflicts.
Ah yep, you're right! I was testing by using the filtering, not highlighting. It definitely looks like highlighting won't match on the Date column at all for some reason. I've added this to our list to fix up and we'll let you know as soon as it's sorted out.
Thanks!
We're a bit late with the follow-ups, but this should be all fixed up in the latest version. Please let us know if you still run into any trouble.
Thanks!
fletch
43 discussion posts
Adding my vote here. I'd like to highlight Warnings and not every log entry that has the word Warning 'somewhere' in it.
