riverar-messageanalyzer-archive/feed/OPNAndConfiguration/TextLogConfiguration/DevicesAndLogs/EventLogCSV.config

//
// Syntax creates a type based on an regex expression
// (?<month>[0-9][0-9]?)/(?<day>[0-9][0-9]?)/(?<year>[0-9][0-9]([0-9][0-9])?) (?<hours>[0-9][0-9]?):(?<minutes>[0-9][0-9]?):(?<secs>[0-9][0-9]?) (?<med>[AP]M)
// 05/09/2014 08:32:41 AM
// Regex: Pass QE Check 8/12/2014
syntax CustomDateTimeFormat = month:regex{[0-9][0-9]?} "/" day:regex{[0-9][0-9]?} "/" year:regex{[0-9][0-9]([0-9][0-9])?} " " hours:regex{[0-9][0-9]?} ":" minutes:regex{[0-9][0-9]?} ":" seconds:regex{[0-9][0-9]?} " " meridian:regex{[AP]M} => (year + "-" + month + "-" + day + " " + hours + ":" + minutes + ":" + seconds + " " + meridian);

//
// Property to return date type given a message of type BaseNetLogon.  Aspects for IsTimestamp allow you to replace the timestamp value.
//
DateTime get eventcsvDateTime(this EventLogDateTime msg) with EntryFieldInfo {IsTimestamp = true, IsLocalTime = false }
{
    if (CustomDateTimeFormat(msg.Date + " " + msg.Time) is dtstr:string)
    {
        if (ToDateTime(dtstr) is dt:DateTime)
        {
            return dt;
        }
        else // two digit year
        {
            if (dtstr.Segment(0, 2) < "50" && ToDateTime("20" + dtstr) is dt2:DateTime)
            {
                return dt2;
            }
            else if (dtstr.Segment(0, 2) >= "50" && ToDateTime("19" + dtstr) is dt3:DateTime)
            {
                return dt3;
            }
            else
            {
                return ToDateTime("1970-01-01T00:00:01.000000") as DateTime;
            }
        }
    }
    else
    {
        return ToDateTime("1970-01-01T00:00:01.000000") as DateTime;
    }
}

//
// Message to capture Sam logon request.
//
message EventLogEntry with
    // Regex: Pass QE Check 8/12/2014
	EntryInfo { Regex = @"(?<Date>[^,]*),(?<Time>[^,]*),(?<Level>[^,]*),(?<ComputerName>[^,]*),(?<EventCode>[^,]*),(?<Source>[^\"",]*),(?<TaskCategory>[^,]*),(?<UserName>[^,]*),\x22(?<Description>.*)\x22"
	}
	: EventLogDateTime
{
	string Level;
	string ComputerName;
	int EventCode;
	string Source;
	string TaskCategory;
	string UserName;
	string Description;
}

message EventLogDateTime : LogEntry
{
	string Date;
	string Time;
}

message EventLogHeader with
    // Regex: Pass QE Check 8/12/2014
	EntryInfo { Regex = @"Date,Time,Type/Level,Computer Name,Event Code,Source,Task Category,Username,Description"
	}
	: LogEntry
{
}

message EventLogEntrySettings with
	EntryInfo {
        // Regex: Pass QE Check 8/12/2014
		Regex = @"(?<Date>[^,]*),(?<Time>[^,]*),(?<Level>[^,]*),(?<ComputerName>[^,]*),(?<EventCode>[^,]*),(?<Source>[^\"",]*),(?<TaskCategory>[^,]*),(?<UserName>[^,]*),\x22"
		, Multiline = parseMultilineContent
	}
	: EventLogDateTime
{
	string Level;
	string ComputerName;
	int EventCode;
	string Source;
	string TaskCategory;
	string UserName;
	string Description;

	bool parseMultilineContent (string line, LineContext context)
	{
		if (context.IsInitialLine)
		{
			return true;
		}
		
		if (CanDecode<EventLogEntry>(line, context) || CanDecode<EventLogEntrySettings>(line, context) )
		{
			return false;
		}
		
		if (Description == nothing)
		{
			Description = line;
		}
		else
		{
			Description = "\n" + (Description as string) + " " + line;
		}
		
		return true;
	}
}

// (?<Date>[^,]*),(?<Time>[^,]*),(?<Level>[^,]*),(?<ComputerName>[^,]*),(?<EventCode>[^,]*),(?<Source>[^\"",]*),(?<TaskCategory>[^,]*),(?<UserName>[^,]*),\x22

/*
		bool parseMultilineContent (string line, LineContext context)
		{
			if (context.IsInitialLine)
			{
				return true;
			}
			
			if (CanDecode<EventHeader>(line, context))
			{
				return false;
			}
			
			if (Message == nothing)
			{
				Message = line.Trim();
			}
			else
			{
				Message = (Message as string) + " " + line.Trim();
			}
			
			return true;
		}
		*/