outputtxt

Records the given field values to the specified file system path as a text file.

Syntax

outputtxt [OPTIONS] FILE_PATH FIELD, ...
Required Parameters
FILE_PATH
Path to save the txt file.
FIELD, ...
Fields to be output in the TXT file, separated by a comma(,).
Optional Parameters
append=BOOL

Enables or disables appending data to the end of the file specified in the FILE_PATH (default: f).

  • t: Appends the field records to the end of the file specified as FILE_PATH. You cannot set this option to t when overwrite=t.
  • f: NOT append the field records to the end of the file specified as FILE_PATH. The query fails if the file exists.
delimiter="CHAR"

Character to use as the field delimiter (default: space).

encoding=CHARSET

Character set (default: utf-8). Use the preferred MIME name or aliases registered in the following document: http://www.iana.org/assignments/character-sets/character-sets.xhtml

flush=INT{y|mon|w|d|h|m|s}

Cycle to flush the output buffer to the file specified as FILE_PATH and flush buffer. You can use one of the cycle units of y (year), mon (month), w (week), d (day), h (hour), m (minute), and s (second). For example, to flush the buffer every 5 seconds, specify 5s.

gz=BOOL

Option to enable compressing text files into a gz archive file (default: f).

  • t: Enables GZIP compression.
  • f: Disables GZIP compression.
overwrite=BOOL

Option to enable overwriting the file specified as FILE_PATH, if it exists (default:f).

  • t: Overwrites the file specified as FILE_PATH, if it exists. You cannot set this option to t when the append=t.
  • f: NOT overwrite the file specified as FILE_PATH, if it exists. The query fails if the file exists.
partition=BOOL

Option to enable macro in the FILE_PATH (default: f).

  • t: Enables macro.
  • f: Disables macro.

You can specify FILE_PATH to change the directory and file path over time using a macro when partition=t. The available macros are {logtime:FMT} and {now:FMT}. For input examples, refer to Usage #2.

  • {logtime:FMT}: Names the directory or file based on the log occurrence time.
  • {now:FMT}: Names the directory or file based on the current time.
Caution
If you set 'partition=t' and do not use a macro on the path, the query fails.
tmp=TMP_FILE_PATH

Path to a temporary file (default: None). Once you set this option, the command creates a temporary file and outputs the result, and moves the file to the path specified by FILE_PATH when the query finishes successfully.

Usage

  1. Record src_ip and dst_ip in the ippair.txt file.

    outputtxt /opt/logpresso/files/ippair.txt src_ip, dst_ip
    
  2. Partition the directory according to the log occurrence date using macro, creates the file name based on the current time, and then records the src_ip and dst_ip field values.

    outputtxt
      partition=t
      /opt/logpresso/{logtime:/yyyy/MM/dd/}-{now:HHmm}.txt
      src_ip, dst_ip