General information about fields mapping is here.
You provide peices of C# code that convert input regexp captures to parts of logical log messages.
Fields mapping code can use any valid C# contructs to do the conversion.
In the scope of the code there exist variables named
as captures you specified in your head and body regexps. These variables have type StringSlice
.
Use helper functions to work with the variables. Do captureName.ToString()
to get standard .Net System.String
object for the capture. Try to make do with without conversion to
System.String
as this conversion is inefficient.
The code can be of two types: Expression or Function Body.
Expresion is like a formula that combines input captures. Examples of expressions
Expression | Description |
---|---|
thread |
Simply returns "thread" capture as is. |
TRIM(thread) |
Returns "thread" capture with leading and trailing spaces removed. |
TO_DATETIME(time, "yyyy-MM-dd HH:mm:ss") |
Takes the capture named "time" and passes it to function TO_DATETIME for parsing. |
logicalThread.Length > 0 ? logicalThread : threadId |
Ternary operator expression that selects one of two captures. |
Function Body is more powerful. It can contain whatever you could put to a C# function: switch contructs, loops, try/catch, etc. Examples:
Function body | Description |
---|---|
switch (level) { case "WARN": return Severity.Warning; case "ERROR": case "FATAL": return Severity.Error; default: return Severity.Info; } |
Maps value of capture "level" to log message severity. It's a function body for field Severity. |