Configuring the extractor component for a rules-based parser

Prerequisites:

In a rules-based log parser, the role of the extractor is to take a collection of input lines provided by the sensor and separate these into message boundaries. To configure the extractor, you need to first determine the extractor class to use. Then, you can configure the Extractor rules based on the selected extractor class.

Configuring the Extractor class

The default extractor class used is a regular expression extractor. You can change the extractor class by modifying the Extractor component in the Contexts section of the Adapter Configuration file.

In the Adapter Configuration Editor, expand the node Contexts > Contexts Basic Context Implementation. The Basic Context Implementation details are shown in the right pane.
Select Component Regular Expression Extractor. The Extractor properties are displayed in the right pane.
Update the executable class to the class you want to use. For details, see the Configuration file structure reference topic for the extractor classes provided by the Generic Log Adapter.
Save the adapter configuration file changes.

Configuring the Extractor rules

Once you determine which extractor class to use, you can write corresponding rules for the extractor in the context instance.

In the left pane of the Adapter Configuration Editor, select Configuration > Context Instance > Extractor. The right pane displays the extractor information.
If the log file contains records that span multiple lines in the file, select the Contains line breaks check box. Do not select this check box if each line in the log file is a separate record or if there are no line breaks in the log file.
If you want to replace the line breaks with an alternative symbol, select Replace line breaks, and type the symbol in the Line Break Symbol field.
Write a script fragment in the Start Pattern field to identify the start pattern. The default regular expression is the caret ^ symbol which is a null token matching the beginning of a string or line.
To include the start pattern in the result, check the Include Start Pattern check box.
Write a script fragment in the End Pattern field to identify the end pattern. The default regular expression is the dollar $ symbol which is a null token matching the end of a string or line.
To include the end pattern in the result, select the Include End Pattern check box.
Hint: To help you with identifying the start and end patterns, click the Re-run icon , then click the Show log icon. The log content that has been read by the sensor is shown in the Sensor Result view.
Save the adapter configuration file to apply changes.
To test your rules, click the Re-run adapter icon to run the adapter. The results will be shown in the Extractor Result view.
Click the Show Next Event icon to see each of the log records that have been processed by the extractor rules you have written.

For a detailed description of extractor properties, see the Adapter Configuration File structure reference document.

The next step in creating a rule-based adapter is to configure the parser component.

Related concepts
Overview of the Hyades Generic Log Adapter

Related tasks
Configuring the parser component