I am trying to match specific values in a file using the "tail" plugin for collectd. I saw on another post that the plugin only supports POSIX ERE syntax. Sample file below:
[18/Jul/2018:23:54:26.388 +0000] SEARCH RESULT instanceName="asdf" threadID=10 conn=1 op=123 msgID=124 requesterIP="asdf" requesterDN="cn=Directory Manager,cn=Root DNs,cn=config" base="cn=System Information,cn=monitor" scope=0 filter="(objectClass=*)" attrs="instanceRoot" resultCode=0 resultCodeName="Success" qtime=1 etime=0.494 preAuthZUsedPrivileges="bypass-acl" entriesReturned=1
[18/Jul/2018:23:54:26.391 +0000] SEARCH RESULT instanceName="asdf" threadID=8 conn=1 op=124 msgID=125 requesterIP="asdf" requesterDN="cn=Directory Manager,cn=Root DNs,cn=config" base="cn=Servers,cn=admin data" scope=0 filter="(objectClass=*)" attrs="1.1" resultCode=32 resultCodeName="No Such Entry" message="Entry cn=Servers,cn=admin data specified as the search base DN does not exist" matchedDN="cn=admin data" qtime=0 etime=0.059 entriesReturned=0
I would like to find the etime number for every SEARCH operation. The regex i came up with seems to work on online regex engine, but does not seem to work with the plugin and fails to compile:
/(?<=\bSEARCH.*etime=)[+-]?([0-9]*[.])?[0-9]+/g
Compiling the regular expression "(?<=\bSEARCH.*etime=)[+-]?([0-9]*[.])?[0-9]+" failed.
What am i missing here?
Why not use something like this?
/ SEARCH .* etime=([0-9.]+) entriesReturned=[0-9]+$/
This assumes that etime= and entriesReturned= always come last, of course. If that assumption is wrong, depending on the actual log entry syntax, it may not be possible to reliably extract the value you are looking for using POSIX extended regular expressions.
Note that only specific DSType specifications actually use the matched value. GaugeInc does not, but others such as CounterSet or GaugeSet will.