Custom parser question

[petermp79]

I have a log message like this:

2022/10/19 00:11:04.475886 27619 INFO thread BasicThreadFactory.cpp:282->execute [obj.34]

source = """
. |= parse_regex!(.message, r'^(?P\d+/\d+/\d+ \d+:\d+:\d+\.\d+) (?P\d+) (?P\w+) (?P\w+) (?P<file_name>\w+).(?P<file_extension>\w+):(?P\d+)->(?P<function_name>\w+) \[?P<thread_name>\]? (?P.*)$')
.tid = to_int!(.tid)
.source_type = "dmnMain"
"""

It gives me this error.

2022-12-09T19:47:37.931377Z ERROR transform{component_kind="transform" component_id=parse_dmnMain component_type=remap component_name=parse_dmnMain}: vector::internal_events::remap: Mapping failed with event. error="function call error for "parse_regex" at (5:247): could not find any pattern matches" error_type="conversion_failed" stage="processing" internal_log_rate_limit=true
2022-12-09T19:47:37.931468Z ERROR transform{component_kind="transform" component_id=parse_dmnMain component_type=remap component_name=parse_dmnMain}: vector::internal_events::remap: Internal log [Mapping failed with event.] is being rate limited.is being rate limited.

I could not decode the error message to pinpoint where the error is:
I looked at Rust regex document, but cant see where the parser's error maybe. Can anyone help?

Thanks

[jszwedko]

Hi @petermp79 !

I'd suggest checking out https://rustexp.lpil.uk/ . That playground uses the same regex library that Vector does and should help you refine the regex. The first thing that jumps out to me is that you have some ?P pattern matching groups that are unnamed (i.e. missing the <name> part of ?P<some group>).

[petermp79]

Will do so. Thanks for the hint, Jesse.