textfile
Loads the data from the text file and returns to the line field.
Syntax
Required Parameter
PATH
-
Path to the file from which to load the data. If you use a wildcard (
*
) in the file name, you can load all files containing a specific string pattern in the file name at once. To load a file, the Logpresso daemon must have the read permission to the file. -
If the extension of the file name to be loaded is
.gz
, Logpresso decompresses and loads the file automatically.
Optional Parameter
You can omit options when creating a query. The omitted option is set to the default value.
brex="REGEX"
-
Regular expression to match the starting row of a record when the record consists of multiple lines. The lines are merged into a single record until a line matching the regular expression appears. If you omit this option, the starting line is recognized based on the newline character (
CRLF
orLF
). -
To match the last line of the record, use the
erex
option. cs=CHARSET
-
Character set (default: utf-8). Use the preferred MIME name or aliases registered in the following document: http://www.iana.org/assignments/character-sets/character-sets.xhtml
df="TIME_FMT"
-
Timestamp format. For example, you may provide
yyyy-MM-dd HH:mm:ss.SSS
. This option is used with thedp
option. dp="REGEX"
-
Regular expression for date extraction. This extracts the timestamp string by a specified regular expression, then parses it into the timestamp format of the
df
option to assign the time type value on the _time field. You can use this with thedf
option.
If you omit this option, the time at which the data is loaded is recorded in the _time field.
erex="REGEX"
-
Regular expression to be used to match the last line of the record if a record consists of multiple lines. The lines are merged into a single record until a line matching the regular expression appears. If you omit this option, the last line is recognized based on the newline character (
CRLF
orLF
). -
To match the starting line of the record, use the
brex
option. limit=INT
-
Maximum number of records to load (default: unlimited).
offset=INT
-
Number of records to skip (default:
0
).
Usage
-
Read the
/var/log/secure
log file.textfile /var/log/secure
-
Read the
iis.txt
file encoded witheuc-kr
.textfile cs=euc-kr iis.txt
-
Read all the
/var/log/syslog.*.gz
file.textfile /var/log/syslog.*.gz