New Custom Regex Log IngestionBy Rachel Fong | Last modified on January 11, 2019
Unstructured text logs are so last decade, but sometimes you have to deal with them because they aren’t actually all that prehistoric in human years…or you just need us to ingest formats we don’t actually support yet.
Matching log lines will be parsed as events, with named regex capture groups corresponding to columns.
As an example, let’s ingest a Rails log file, one of a class of many objects that I would much rather never look through manually.
Just construct a regex that pulls out the fields you want, and pass it to
honeytail to get your awful looking log dumps parsed and ready to investigate in Honeycomb.
honeytail --writekey=MYWRITEKEY --dataset=MYDATASET ` --parser=”regex” --regex.timefield="time" `` --regex.line-regex=”(?P<time>S+) (?P<source>.*): at=(?P<log_level>.*) method=(?P<http_method>.*) path="(?P<path>.*) ..."`
Fascinating! Suspicious! Weird, even! Mostly, I’m excited that I can now click to sort all my requests by latency and filter to instantly see time-series graphs, instead of artisanally constructing an elaborate series of bash pipes.
Multiple line formats
We support passing multiple patterns, so you can parse logs with mixed output formats into the same dataset by adding additional
—regex.line_regex flags to your
honeytail call. (Order matters when we regex match your log lines, so put your most specific regexes first.)
honeytail --writekey=MYWRITEKEY --dataset=MYDATASET `` --parser=”regex” --regex.timefield="time" ` --regex.line-regex=”(?P<time>S+) (?P<source>.*): at=(?P<log_level>.*) method=(?P<http_method>.*) path="(?P<path>.*) ..." ` --regex.line-regex=”(?P<time>S+) (?P<source>.*): (?P<msg>.*)”`
- Nested capture groups are supported!
(?P<outer>[^ ]* (?P<inner1>[^ ]*) (?P<inner2>[^ ]*))(Field names are WYSIWYG, e.g.
- Multiline regexes are not supported
- Uses Google’s RE2 syntax
Our friends at Tracetest recently released an integration with Honeycomb that allows you to build end-to-end and integration tests, powered by your existing distributed traces....