riverar-messageanalyzer-archive/feed/OPNAndConfiguration/TextLogConfiguration/DevicesAndLogs/SQLServerError.config

message SQLServerEntry : LogEntry
{
    DateTime Date with EntryFieldInfo {IsTimestamp = true, IsLocalTime = true};
    string Source;
    string Message where ErrorCodeIf(value.IndexOf("Error:") >= 0, this, DiagnosisLevel.Error, value);
    // map for the parameters
    // key: parameter option, value: parameter value
    optional map<string, string> Parameters = nothing;

    override string ToString()
    {
        return Message;
    }
    
    // one SQL Server log may exist in multiple lines
    bool ParseContent(string line, LineContext context)
    {
        if (context.IsInitialLine)
        {
            return true;
        }
        SQLServerEntry sqlServerEntry = Decode<SQLServerEntry>(line, context);
        if (sqlServerEntry != null)
        {
            // can decode as SQLServerEntry, check whether Message initialized as "\t"
            if (sqlServerEntry.Message[0] != '\t')
            {
                return false;
            }
            
            HandleNextLine(sqlServerEntry.Message.Trim());
            return true;
        }
        
        HandleNextLine(line.Trim());
        return true;
    }
    
    void HandleNextLine(string nextLine)
    {
        // for multiple lines, if the starting with parameter format, such as '-a', '-b', decode as parameter map
        if (nextLine.Count > 2 && nextLine[0] == '-' && nextLine[2] == ' ' &&
            ((nextLine[1] >= 'a' && nextLine[1] <= 'z') || (nextLine[1] >= 'A' && nextLine[1] <= 'Z')))
        {
            if (Parameters == nothing)
            {
                Parameters = {nextLine.Segment(0, 2) -> nextLine.Segment(2)};
            }
            else
            {
                Parameters = (Parameters as map<string, string>) + {nextLine.Segment(0, 2) -> nextLine.Segment(2)};
            }
        }
        else
        {
            Message += " " + nextLine;
        }
    }
}
with EntryInfo
{
    Regex = @"^(?<Date>[-/\.\:0-9]+\s[-/\.\:0-9]+)\s(?<Source>[^\s]+)\s+(?<Message>.*)",
    Multiline = ParseContent
};