tstack / lnav

Log file navigator
http://lnav.org
BSD 2-Clause "Simplified" License
7.97k stars 322 forks source link

Execute command when log event matches a pattern #1311

Open sbhal opened 1 month ago

sbhal commented 1 month ago

I want to use the lnav Events interface to search for regex in live log files and run a command when a match is found. Do you have any suggestions on how to do this?

Eventually, I want to search log files for when a long-running process finishes, and I want to be notified when it's done.

I also couldn't find a way to execute non-SQL commands when a log event occurs.

FaffeF commented 1 month ago

Have you looked into shell_exec? https://docs.lnav.org/en/latest/sqlext.html#shell-exec-cmd-input-options

tstack commented 1 month ago

I also couldn't find a way to execute non-SQL commands when a log event occurs.

Are you trying to execute an lnav command or a shell program? Most of lnav's functionality can be accessed through SQL vtables.

sbhal commented 1 month ago

I am trying to execute a shell command once log body matches a regex pattern.

I added a watch expression:

:config /log/watch-expressions/testfinished/expr regexp(:log_body, '.*Test run finished .*')

But I am noticing, there are no entries in lnav_events table using

;select * from lnav_events

I also have init sql

CREATE TRIGGER IF NOT EXISTS add_integ_tests_log_events
  AFTER INSERT ON lnav_events WHEN
    -- Check the event type
    jget(NEW.content, '/$schema') =
      'https://lnav.org/event-log-msg-detected-v1.schema.json' AND
    -- Only create the filter when a given format is seen
    jget(NEW.content, '/watch-name') = 'testfinished'
BEGIN
SELECT shell_exec('notify "test finished!"');
END;
tstack commented 1 month ago

I am trying to execute a shell command once log body matches a regex pattern.

I added a watch expression:

:config /log/watch-expressions/testfinished/expr regexp(:log_body, '.*Test run finished .*')

I think you have the arguments to regexp() flipped around. The regular expression should come first.