regexmultilinenxlog

NXLOG how to merge multilines regex

I have a log like this:

14:40:33.476 [WebContainer : 149] sometihng sometihng 
14:40:33.476 [WebContainer : 149] sometihng sometihng 
14:40:33.476 [WebContainer : 149] sometihng sometihng 
14:40:33.476 [WebContainer : 245] csometihng sometihng 
14:40:33.476 [WebContainer : 245] sometihng sometihng 
14:40:33.476 [WebContainer : 245] sometihng sometihng

I use nxlog to send this to kafka, what I want is to merge all lines with "WebContainer : 149" into one, and next line when this changes and so on.

Solution

  • You can use the following regex to capture all the lines with a certain value:

    /(.*\[WebContainer : (\d+)\]\s*(.*))+\s+.*\[WebContainer : \2\]\s(.*)+\s+.*\[WebContainer : \2\]\s(.*)+/g

    The regex matches any number of any char up to '[WebContainer : ', then matches any number and a right Square bracket before matcing White Spaces.

    Then it starts all over Again (a new line), only here it uses capturing Group 2 to specify the number. This is repeated on the third line.

    Then replace the matches with :

    $1$3$4

    Now you will get one line per number, combining the 'sometihng' from each line.