trường hợp là như thế này.
team bạn push log lên coralogix. trong body nó có 1 trường là time_ms = xxx
Team muốn nhờ devops based on that value để vẽ lên one graph
![](https://nimtechnology.com/wp-content/uploads/2023/12/image-3.png?v=1702008834)
trong coralogix có 1 tính năng là Log Parsing Rules
![](https://nimtechnology.com/wp-content/uploads/2023/12/image-4.png?v=1702010865)
Bạn có thể tách nó ra thành 1 field.
![](https://nimtechnology.com/wp-content/uploads/2023/12/image-5.png?v=1702011082)
Bạn sẽ chọn extract
![](https://nimtechnology.com/wp-content/uploads/2023/12/image-8.png?v=1702021166)
time\_ms=(?P<time_ms>\d+)
Giở bạn cần test bằng copy 1 sample log, bằng cách dưới.
![](https://nimtechnology.com/wp-content/uploads/2023/12/image-6.png?v=1702011295)
![](https://nimtechnology.com/wp-content/uploads/2023/12/image-7.png?v=1702021055)
Giờ bạn quay lại parsing rule and recheck:
![](https://nimtechnology.com/wp-content/uploads/2023/12/image-9.png?v=1702021553)
Tiếp đến bạn nhấn save.
![](https://nimtechnology.com/wp-content/uploads/2023/12/image-10.png?v=1702021598)
sau thời gian đợi có log mới đã push lên thì time_ms đã có 1 field
![](https://nimtechnology.com/wp-content/uploads/2023/12/image-13.png)
—> continue …
How to find out the right regEx
Mình sẽ cho bạn một cái promt:
Only generate regex pattern to extract number of 'time_ms' to a JSON field. -example log: {"resource":{"attributes":{"k8s.container.name":"argocd-application-controller","k8s.container.restart_count":"0","k8s.namespace.name":"argocd","k8s.node.name":"k8s-worker1","k8s.pod.name":"argocd-application-controller-0","k8s.pod.uid":"543d7e96-3488-4c27-adc3-e7afdae0c3f7","k8s.statefulset.name":"argocd-application-controller"}},"scope":{"attributes":{}},"logRecord":{"attributes":{"cluster_name":"nimtechnology-k0s","log.file.path":"\/var\/log\/pods\/argocd_argocd-application-controller-0_543d7e96-3488-4c27-adc3-e7afdae0c3f7\/argocd-application-controller\/0.log","log.iostream":"stderr","logtag":"F","time":"2023-12-08T01:17:35.733171764Z"},"body":"time=\"2023-12-08T01:17:35Z\" level=info msg=\"Reconciliation completed\" application=argocd\/kubecost dedup_ms=0 dest-name= dest-namespace=kubecost dest-server=\"https:\/\/kubernetes.default.svc\" diff_ms=723 fields.level=2 git_ms=204 health_ms=2 live_ms=11 patch_ms=14 setop_ms=0 settings_ms=0 sync_ms=0 time_ms=1085","observedTimeUnixNano":1701998255880908107,"timeUnixNano":1701998255733171764}} -example regex: op_msg\s+(?P<op_msg>\d+)
Bạn sử dụng chatgpt để tìm ra regex hợp lý.