From 99e530479ac1cd6ec1d6b103c1bcc50d7a7eaf2c Mon Sep 17 00:00:00 2001 From: Clark Boylan Date: Mon, 24 Mar 2014 12:16:56 -0700 Subject: [PATCH] Don't treat IDs as uniquely special in CRM114 The openstack logs a full of various IDs and UUIDs but they are not uniquely special when it comes to filtering them. Instead replace each ID with a token making CRM114's life much easier. Change-Id: Id9b430c0d31889b89e4e0c1790a2405d73f501b5 --- modules/log_processor/files/classify-log.crm | 33 ++++++++++++++++++++ 1 file changed, 33 insertions(+) diff --git a/modules/log_processor/files/classify-log.crm b/modules/log_processor/files/classify-log.crm index a2e7a22945..66b02bc48a 100755 --- a/modules/log_processor/files/classify-log.crm +++ b/modules/log_processor/files/classify-log.crm @@ -57,6 +57,39 @@ learn [:_nl:] (:*:prefix:/FAILURE.css) match (:timestamp:) /^[-.0-9 |:]+/ alter (:timestamp:) // } + { + # Don't treat UUIDs as uniquely special. + match (:uuidtoken:) /[[:xdigit:]]{8}-[[:xdigit:]]{4}-[[:xdigit:]]{4}-[[:xdigit:]]{4}-[[:xdigit:]]{12}/ + alter (:uuidtoken:) /UUIDTOKEN/ + { + match (:uuidtoken:) /[[:xdigit:]]{8}-[[:xdigit:]]{4}-[[:xdigit:]]{4}-[[:xdigit:]]{4}-[[:xdigit:]]{12}/ + alter (:uuidtoken:) /UUIDTOKEN/ + # Loop to replace all TOKENS in line + liaf + } + } + { + # Don't treat IDs as uniquely special. + match (:idtoken:) /[[:xdigit:]]{32,40}/ + alter (:idtoken:) /IDTOKEN/ + { + match (:idtoken:) /[[:xdigit:]]{32,40}/ + alter (:idtoken:) /IDTOKEN/ + # Loop to replace all TOKENS in line + liaf + } + } + { + # Don't treat IDs as uniquely special. + match (:numtoken:) /-[[:digit:]]{7,}/ + alter (:numtoken:) /-NUMTOKEN/ + { + match (:numtoken:) /-[[:digit:]]{7,}/ + alter (:numtoken:) /-NUMTOKEN/ + # Loop to replace all TOKENS in line + liaf + } + } # Train on the line learn (:*:prefix:/:*:target:.css) # Classify the line to see if it looks more like a SUCCESS or FAILURE line