textfile

Loads the data from the text file and returns to the line field.

Syntax

textfile [OPTIONS] PATH
Required Parameter
PATH

Path to the file from which to load the data. If you use a wildcard (*) in the file name, you can load all files containing a specific string pattern in the file name at once. To load a file, the Logpresso daemon must have the read permission to the file.

If the extension of the file name to be loaded is .gz, Logpresso decompresses and loads the file automatically.

Optional Parameter

You can omit options when creating a query. The omitted option is set to the default value.

brex="REGEX"

Regular expression to match the starting row of a record when the record consists of multiple lines. The lines are merged into a single record until a line matching the regular expression appears. If you omit this option, the starting line is recognized based on the newline character (CRLF or LF).

To match the last line of the record, use the erex option.

cs=CHARSET

Character set (default: utf-8). Use the preferred MIME name or aliases registered in the following document: http://www.iana.org/assignments/character-sets/character-sets.xhtml

df="TIME_FMT"

Timestamp format. For example, you may provide yyyy-MM-dd HH:mm:ss.SSS. This option is used with the dp option.

dp="REGEX"

Regular expression for date extraction. This extracts the timestamp string by a specified regular expression, then parses it into the timestamp format of the df option to assign the time type value on the _time field. You can use this with the df option.

If you omit this option, the time at which the data is loaded is recorded in the _time field.

erex="REGEX"

Regular expression to be used to match the last line of the record if a record consists of multiple lines. The lines are merged into a single record until a line matching the regular expression appears. If you omit this option, the last line is recognized based on the newline character (CRLF or LF).

To match the starting line of the record, use the brex option.

limit=INT

Maximum number of records to load (default: unlimited).

offset=INT

Number of records to skip (default: 0).

Usage

  1. Read the /var/log/secure log file.

    textfile /var/log/secure
    
  2. Read the iis.txt file encoded with euc-kr.

    textfile cs=euc-kr iis.txt
    
  3. Read all the /var/log/syslog.*.gz file.

    textfile /var/log/syslog.*.gz