Ad Widget

Collapse

Regexp in log item creates log entry twice

Collapse
X
 
  • Time
  • Show
Clear All
new posts
  • Baymon
    Junior Member
    • Jan 2021
    • 12

    #1

    Regexp in log item creates log entry twice

    Hi,

    i monitor a logfile, a line in the logfile looks like this:

    2022-07-18 14:50:41-[HOSTNAME] This is the message
    My item key looks like this:

    log[/var/log/zabbix/monitor.log,".HOSTNAME. This is the message"]
    This wokrs perfect, it gives me one match with one entry in the Zabbix Latest data log

    In order to exactly match the line i modified the item like this:

    log[/var/log/zabbix/monitor.log,"^(.HOSTNAME. This is the message)$"]
    This should not match at all because the timestamp is missing. But anyhow, i get log entries in the Latest data and with this item i have exactly the same log entry twice. What is going wrong here?
  • Baymon
    Junior Member
    • Jan 2021
    • 12

    #2
    After some tests with https://regex101.com/ i found out, the double match is because of a normal match and a group match.

    Comment

    • dimir
      Zabbix developer
      • Apr 2011
      • 1080

      #3
      Yeah, you should have specified the output:
      Code:
      log[/var/log/zabbix/monitor.log,".*(.HOSTNAME. This is the message).*",,,,"\1"]

      Comment

      Working...