How to replace search time with "time" field in fluentbit? - fluent-bit

I defined a customized multiline parser with regex and another parser to split time and log line into fields "time" and "message" respectively:
How could I replace the search time with the value of "time"?
Here is my multiline parser, invoked with tail input:
[MULTILINE_PARSER]
name jsm
type regex
flush_timeout 1000
# rules | state name | regex pattern | next state
# ------|---------------|--------------------------------------------
rule "start_state" "/(\d{4}\-\d{2}-\d{2} \d{2}\:\d{2}\:\d{2}\,\d+[\+\-]\d+)(.*)/" "cont"
rule "cont" "/^[\s+at|java|Caused]/" "cont"
Here is the parser:
[PARSER]
Name jsm
Format regex
Regex /^(?<time>\d{4}\-\d{2}-\d{2} \d{2}\:\d{2}\:\d{2}\,\d+[\+\-]\d+) (?<message>.*)/m
The parser above is invoked in Filter:
[FILTER]
name parser
match *
key_name log
parser jsm
Thanks.
Try to find a solution to complete this search.

Issue fixed after adding a parameter Time_Format in Parser jsm, this has to match the time format in the log entry, otherwise it will be ignored.

Related

weaviate aggregate by reference property

I want to build an aggregate query on my data.
I have Patents class that have references of Paragraphs classes (paragraphs that have vectorized text),
I want to count patents for each catagory (property of patent) that are near vector.
in psuedo SQL:
select (count distinct Patent)
from myweaviate
where Paragraph.nearVector(vector, certainty=0.9)
group by catagory
I tried using something like (which is also bad even if it worked because it counts paragraphs):
result = (client.query.aggregate("Paragraph") \
.with_group_by_filter(["inPatent{... on Patent{publicationID}"]) \
.with_fields('meta { count }') \
.with_fields('groupedBy {value}') \
.with_near_vector({'vector': vector, 'certainty': 0.8}) \
.do())
and getting:
{'data': {'Aggregate': {'Paragraph': None}}, 'errors': [{'locations': [{'column': 12, 'line': 1}], 'message': "could not extract groupBy path: Expected a valid property name in 'path' field for the filter, but got 'inPatent{... on Patent{publicationID}'", 'path': ['Aggregate', 'Paragraph']}]}
I couldn't find any source in the docs or in the internet to do something like that, (aka use aggregate on reference property),
additionally, doing a count distinct (but in this case the Patent class is distinct of course)
can anyone help?
unfortunately it is not possible to do grouping by cross-references. The error in your case means that you did not construct a valid path, that is because the path needs to be a list where each item is a valid configuration, i.e. the path should be like this: path: ["inPatent", "Patent", "publicationID"]. It goes property -> class name -> property -> class name -> ... til your desired field. Currently Weaviate does not support Aggregate.groupBy with cross references, if you run your query again with the correct path you should get something like this:
"message": "shard 9wKKa18SJOiM: identify groups: grouping by cross-refs not supported"
Note that it is possible to use the cross reference property as your groupBy path (since you want to Aggregate on the Patent ID, it means that the UUID (and beacon) of the Patent object are unique has a one-to-one mapping to the publicationID ), and it should look like this:
result = (client.query.aggregate("Paragraph") \
.with_group_by_filter(["inPatent"]) \
.with_fields('meta { count }') \
.with_fields('groupedBy {value}') \
.with_near_vector({'vector': vector, 'certainty': 0.8}) \
.do())

filter paths that have only one "/" in R using regular expression

I have a vector of different paths such as
levs<-c( "20200507-30g_25d" , "20200507-30g_25d/ggg" , "20200507-30g_25d/grn", "20200507-30g_25d/ylw", "ggg" , "grn", "tre_livelli", "tre_livelli/20200507-30g_25d", "tre_livelli/20200507-30g_25d/ggg", "tre_livelli/20200507-30g_25d/grn", "tre_livelli/20200507-30g_25d/ylw" , "ylw" )
which is actually the output of a list.dirs with recursive set to TRUE.
I want to identify only the paths which have just one subfolder (that is "20200507-30g_25d/ggg" , "20200507-30g_25d/grn", "20200507-30g_25d/ylw").
I thought to filter the vector to find only those paths that have only one "/" and then compare the this with the ones that have more than one "/" to get rid of the partial paths.
I tried with regular expression such as:
rep(levs,pattern='/{1}', value=T)
but I get this:
"20200507-30g_25d/ggg" "20200507-30g_25d/grn" "20200507-30g_25d/ylw" "tre_livelli/20200507-30g_25d" "tre_livelli/20200507-30g_25d/ggg" "tre_livelli/20200507-30g_25d/grn" "tre_livelli/20200507-30g_25d/ylw"
Any idea on how to proceed?
/{1} is a regex that is equal to / and just matches a / anywhere in a string, and there can be more than one / inside it. Please have a look at the regex tag page:
Using {1} as a single-repetition quantifier is harmless but never useful. It is basically an indication of inexperience and/or confusion.
h{1}t{1}t{1}p{1} matches the same string as the simpler expression http (or ht{2}p for that matter) but as you can see, the redundant {1} repetitions only make it harder to read.
You can use
grep(levs, pattern="^[^/]+/[^/]+$", value=TRUE)
# => [1] "20200507-30g_25d/ggg" "20200507-30g_25d/grn" "20200507-30g_25d/ylw" "tre_livelli/20200507-30g_25d"
See the regex demo:
^ - matches the start of string
[^/]+- one or more chars other than /
/ - a / char
[^/]+- one or more chars other than /
$ - end of string.
NOTE: if the parts before or after the only / in the string can be empty, replace + with *: ^[^/]*/[^/]*$.
An option with str_count to count the number of instances of /
library(stringr)
levs[str_count(levs, "/") == 1 ]
-ouptut
[1] "20200507-30g_25d/ggg" "20200507-30g_25d/grn"
[3] "20200507-30g_25d/ylw" "tre_livelli/20200507-30g_25d"

kusto query with dynamic object value without key

I have a lot of data looking like
{"tuesday":"<30, 60>"}
{"friday":"<0, 5>"}
{"saturday":"<5, 10>"}
{"friday":"<0, 5>"}
{"saturday":"<5, 10>"}
{"sunday":"0"}
{"monday":"<0, 5>"}
All i want is the value regardless of the key.
My query:
customEvents
| where name == "eventName"
| extend d = parse_json(tostring(customDimensions.['Properties']))
| project d
| take 7
d is a dynamic object and I can do d.monday for the value, but I'd like to get the value without the key. Is this possible with Kusto?
Thanks
for the case of a single-property as you've demonstrated above, using the parse operator could work:
datatable(d:dynamic)
[
,dynamic({"tuesday":"<30, 60>"})
,dynamic({"friday":"<0, 5>"})
,dynamic({"saturday":"<5, 10>"})
,dynamic({"friday":"<0, 5>"})
,dynamic({"saturday":"<5, 10>"})
,dynamic({"sunday":"0"})
,dynamic({"monday":"<0, 5>"})
]
| parse d with * ':"' value '"' *
| project value
Notes:
In case your values are not necessarily encapsulated in double quotes (e.g. are numerics), then you should be able to specify kind=regex for the parse operator, and use a conditional expression for the existence of the double quotes.
In case you have potentially more than 1 property per property bag, using extract_all() is an option.
Relevant Docs:
https://learn.microsoft.com/en-us/azure/kusto/query/parseoperator
https://learn.microsoft.com/en-us/azure/kusto/query/extractallfunction

org.springframework.validation.Errors.rejectValue doesn't escape values

I am trying to add escaped values to an error message in a Spring MVC Validator
final Object[] vatErrorArray = new String[2];
vatErrorArray[0] = "aaa";
vatErrorArray[1] = "bbb";
errors.rejectValue("vatfield", "vendor.vat.number.invalid.pattern.generic", vatErrorArray, "Invalid VAT");
where vendor.vat.number.invalid.pattern.generic is as follows:
vendor.vat.number.invalid.pattern.generic=VAT Number's pattern is invalid for {0}. Valid pattern: {1}.
Unfortunately, the displayed error message doesn't contain the escaped values:
VAT Numbers pattern is invalid for {0}. Valid pattern: {1}.
What am I doing wrong?
PS I am using Spring MVC version 4.2.1.RELEASE
I think you need to change the single quote in Number's to two single quotes ('').
I haven't tried it myself but am basing this mostly on the content of this question, and the MessageFormat docs it links to, plus the fact that your single quote seems to be disappearing.

grep string from a TCL variable

I want to grep a certain amount of string from a TCL variable and use that in my tool command. Example:
${tcl_Var} - this contains string like VEG_0_1/ABC
I want to grep from above string until it the point it hits first forward slash, so in the above case it would be VEG_0_1. And then replace it in my command. Example:
VEG_0_1/REST_OF_THE_COMMAND.
Don't think in terms of grep, think about "string manipulation" instead.
Use regsub for "search and replace:
% set tcl_Var VEG_0_1/ABC
VEG_0_1/ABC
% set newvar [regsub {/.+} $tcl_Var {/REST_OF_THE_COMMAND}]
VEG_0_1/REST_OF_THE_COMMAND
Alternately, your problem can be solved by splitting the string on /, taking the first component, then appending the "rest of the command":
% set newvar "[lindex [split $tcl_Var /] 0]/REST_OF_THE_COMMAND"
VEG_0_1/REST_OF_THE_COMMAND
Or using string indices:
% set newvar "[string range $tcl_Var 0 [string first / $tcl_Var]]REST_OF_THE_COMMAND"
VEG_0_1/REST_OF_THE_COMMAND
You can do this with regular expressions using the regsub TCL command. There is no need to run the external program grep. See more info here: http://www.tcl.tk/man/tcl8.4/TclCmd/regsub.htm
If you are new to regular expressions, read TCL-specific tutorial about them.
set tcl_Var VEG_0_1/ABC
set varlist [split $tcl_Var "/"]
set newvar [lindex $varlist 0]/REST_OF_THE_COMMAND

Resources