Log format not recognised

[leemari]

So I have a log file with a line like this.

2019-06-15 23:39:37.2899|ERROR|Test.Program|Something went wrong

It should be matched by the default Pipe separated log format, & I have below highlighting pattern

^\s*E(RROR)?\s*$

If I try all of these pattern matches on any online regular expression tester they match, so why does IDEOLOG say?

• Log format not recognized
• no highlighting

[abinesh92]

I have similar situation.

I have following lines

15:14:28 root         DEBUG   MainThread New Database parameters: Schema:  | Traceability Table: something
15:14:28 root         INFO    MainThread =======================  Test Product - 3.3.0-rc.5  =======================
15:14:28 Utility      INFO    KeyListenerThrd Keyboard listener started.
15:14:28 Utility      ERROR   MainThread MD5 Calc - File missing: .\dist\TestProduct-rc.5.exe
15:14:28 Utility      INFO    MainThread MD5 Hash code: c8f63d116ec85b1470938767cb77a2ca for files: [u'TestProduct_3.3.0-rc.5.exe', u'.\\dist\\TestProduct_3.3.0-rc.5.exe', 'C:\\Github\\Manufacturing-Tests\\ProdTest\\TestProduct\\dist\\version']
15:14:28 Utility      INFO    MainThread Ping successfull: http://google.com (timeout: 3)

with log format

(?:^(?<date>\d+:\d+:\d+)\s+(?<module>[^\s]+)\s+(?<level>[^\s]+)\s+(?<thread>[^\s]+)\s+(?<msg>.*?))(?=\n^(?:\d+:\d+:\d+))

and message start pattern

^\d{2}:

It gets matched well in online regular expression tester but not in IDEOLOG. I get the error Log format not recognized.

[turururu-zz]

Same here: Example log: WEB 2021-01-25 08:40:07,296 DEBUG [com.google] [xxx]: message 1 WEB 2021-01-25 09:00:05,387 DEBUG [com.google] [xx]: message 2 more more WEB 2021-01-25 09:02:04,156 DEBUG [com.google] [xx]: message 3

Message pattern: ^(\w)\s(\d-\d-\d \d:\d:\d,\d)\s(\w)\s([.?])\s([.?]):\s(.+)$

Message start pattern: ^WEB

Time format: yyyy-MM-dd HH:mm:ss,SSS

time group: 2 severity group:3 category group: 4

If i search any patter above i have a match in intellij.

[MrFiregore]

Same here: Example log: [2021-06-17 16:31:49] local.INFO: TelegramJob d51e4151-1463-42c2-9246-550ec3b65d50 start {"inputs":[],"session":[]}

Message pattern: ^[([\d\s:-]+)] ([^.]+).([^:]+): (.)({})$

Message start pattern: ^[

Time format: yyyy-MM-dd HH:mm:ss

time group: 1 severity group:3 category group: 2

[Luc4G3r]

Same here: Example log: [2021-09-09 08:04:15] configuration_logger.INFO: SKIMMER LOG: 59144 size 5770 depth 5763 STAMPINGS ["5918","5919","5920","5921","5960"] first 5918

Message pattern: ^\[([^]]+)\s*\]\s+([\w\s]+)[.:]+([\w]+)[.:](.+)$

Message start pattern: ^[

Time format: yyyy-MM-dd HH:mm:ss

time group: 1 severity group: 3 category group: 2

[katnova]

Same here: Example log: 2021-10-08T09:37:54+0000 <info> bot.js:324 (validateAPIToken) Validating token. Wating for response from Ниетворк...

Message pattern: ^([0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}(\.[0-9]+)?([zZ]|([\+-])([01]\d|2[0-3])):?([0-5]\d)?)?\s<([a-zA-Z]+)>\s[a-zA-Z]+\.j*.:[0-9]+\s\((.*)\)(\s+([a-zA-Z]+\s+)+).*$

Message start pattern: ^\d

Time format: YYYY-MM-DD'T'hh:mm:ss'Z'

Time capture group: 1 Severity capture group: 7 Category capture group: 8

[rtphokie]

Same here, even the most basic of regex patters isn't matched and PyCharm continues to complain of "Log format not recognized"

message pattern: ^(?s)([^|])|(?s)([^|])|(?s)([^|]*)$

Message start pattern: ^\d

Example logline: 2021-11-29 10:33:44,816|INFO|this is a log messsage

This was broken more than a year ago, any word on when it might be fixed?

[ThatOtherAndrew]

Same issue here. Even with a message pattern of ^.*$ and a message start pattern of ^., nothing works.

[reynadan]

Another example to the list, I don't think custom log format is even working :/ Log file :

2022-05-04 11:24:23 627246475c1e2   172.18.0.1  ITSDEVDB_01 ERR_PHP     WARNING EXCEPTION1
2022-05-04 11:24:23 627246475c1e2   172.18.0.1  ITSDEVDB_01 ERR_PHP     WARNING EXCEPTION2

Message pattern

^(\d{4}-\d{2}-\d{2}\s+\d{2}:\d{2}:\d{2})\s+(\w+)\s+(\w+\.\w+\.\w+\.\w+)\s+(\w+)\s+(ERR_PHP)\s+(\w+)?(.*)$

Message start pattern

^\d

Time format

yyyy-MM-dd HH:mm:ss

Pattern is verified :

but still...

EDIT : Needed 5 lines of log, still no folding of highlighting

[sergpitk]

Pay attention to the time format yyyy-MM-dd'T'HH:mm:ss.SSSSSSXXX this message pattern works ^[(\d{4}-\d{2}-\d{2}.\d{2}:\d{2}:\d{2}.\d{6}+\d{2}:\d{2})]\s+(\w+).(\w+):\s+(.*)$ in case of message like [2022-06-21T06:47:42.838925+00:00] doctrine.DEBUG: Executing query: SELECT DATABASE() {"sql":"SELECT DATABASE()"} []

[gnut-neygun]

Any update on this issue?

[tazz4843]

I found this issue while searching, but I then found this comment: https://github.com/JetBrains/ideolog/issues/110#issuecomment-1237569712

Restarting CLion instantly loaded the logs and they were parsed successfully. If they pass a regex tester, and the capture groups and timestamps are correct, they should be detected just fine.

[Rampftl]

I had the same experience as tazz4843 with Rider. Restarting the IDE helps.

[karlkras]

I've been having this issue now too. Here's my l4j rolling file appender:

        <RollingFile name="File" filePattern="${basePath}/app-%d{yyyy-MM-dd}.log">
            <PatternLayout pattern="%d{HH:mm:ss.SSS} %-5level %c{2} -%msg%n"/>
            <Policies>
                <TimeBasedTriggeringPolicy interval="1" modulate="true"/>
                <SizeBasedTriggeringPolicy size="100 KB"/>
            </Policies>
        </RollingFile>

and the log editor can't figure out what to do with this format... Attached is a sampling of my log... app-2023-09-27.log

[LaurinHerbsthofer]

For me it got fixed once I had 6 or more lines in the log file. Having 5 or less lines will always show "Log format not recognized".

I think this is very strange behaviour. At least the "Log format not recognized" error/warning message should be more specific in this case to indicate that log file formatting is only enabled when there are more than 5 lines present in the file.

[karlkras]

I only shortened it to save bandwidth. With thousands of lines it has the same problem.

[jtreminio]

I was able to get this to work by not including the regex for the date.

Given a log format message like 2024-03-22 19:07:06.755922 [info] message here, the following settings worked:

• Message pattern: \[(\S+)\] (.*)$
• Message start pattern: ^\d
• Time format: yyyy-MM-dd HH:mm:ss.SSSSSS
• Time capture group: 1
• Severity capture group: 2
• Pattern: ^\s*info\s*$