public DateTime GetTimestamp(LogExpert.ILogLineColumnizerCallback callback, ILogLine line)
{
IColumnizedLogLine cols = SplitLine(callback, line);
if (cols == null || cols.ColumnValues == null || cols.ColumnValues.Length < 2)
{
return(DateTime.MinValue);
}
if (cols.ColumnValues[0].FullValue.Length == 0 || cols.ColumnValues[1].FullValue.Length == 0)
{
return(DateTime.MinValue);
}
FormatInfo formatInfo = _timeFormatDeterminer.DetermineDateTimeFormatInfo(line.FullLine);
if (formatInfo == null)
{
return(DateTime.MinValue);
}
try
{
DateTime dateTime = DateTime.ParseExact(
cols.ColumnValues[0].FullValue + " " + cols.ColumnValues[1].FullValue, formatInfo.DateTimeFormat,
formatInfo.CultureInfo);
return(dateTime);
}
catch (Exception)
{
return(DateTime.MinValue);
}
}
public DateTime GetTimestamp(LogExpert.ILogLineColumnizerCallback callback, ILogLine line)
{
IColumnizedLogLine cols = SplitLine(callback, line);
if (cols == null || cols.ColumnValues.Length < 8)
{
return(DateTime.MinValue);
}
if (cols.ColumnValues[2].FullValue.Length == 0)
{
return(DateTime.MinValue);
}
try
{
DateTime dateTime = DateTime.ParseExact(cols.ColumnValues[2].FullValue, "dd/MMM/yyyy:HH:mm:ss zzz",
new CultureInfo("en-US"));
return(dateTime);
}
catch (Exception)
{
return(DateTime.MinValue);
}
}
public void PushValue(LogExpert.ILogLineColumnizerCallback callback, int column, string value, string oldValue)
{
if (column == 2)
{
try
{
DateTime newDateTime =
DateTime.ParseExact(value, "dd/MMM/yyyy:HH:mm:ss zzz", new CultureInfo("en-US"));
DateTime oldDateTime =
DateTime.ParseExact(oldValue, "dd/MMM/yyyy:HH:mm:ss zzz", new CultureInfo("en-US"));
long mSecsOld = oldDateTime.Ticks / TimeSpan.TicksPerMillisecond;
long mSecsNew = newDateTime.Ticks / TimeSpan.TicksPerMillisecond;
this.timeOffset = (int)(mSecsNew - mSecsOld);
}
catch (FormatException)
{
}
}
}
public static bool TestFilterCondition(FilterParams filterParams, ILogLine line,
LogExpert.ILogLineColumnizerCallback columnizerCallback)
{
if (filterParams.lastLine.Equals(line.FullLine))
{
return(filterParams.lastResult);
}
bool match = TestFilterMatch(filterParams, line, columnizerCallback);
filterParams.lastLine = line.FullLine;
if (filterParams.isRangeSearch)
{
if (!filterParams.isInRange)
{
if (match)
{
filterParams.isInRange = true;
}
}
else
{
if (!match)
{
match = true;
}
else
{
filterParams.isInRange = false;
}
}
}
if (filterParams.isInvert)
{
match = !match;
}
filterParams.lastResult = match;
return(match);
}
public void PushValue(LogExpert.ILogLineColumnizerCallback callback, int column, string value, string oldValue)
{
if (column == 1)
{
try
{
FormatInfo formatInfo = _timeFormatDeterminer.DetermineTimeFormatInfo(oldValue);
if (formatInfo == null)
{
return;
}
DateTime newDateTime = DateTime.ParseExact(value, formatInfo.TimeFormat, formatInfo.CultureInfo);
DateTime oldDateTime = DateTime.ParseExact(oldValue, formatInfo.TimeFormat, formatInfo.CultureInfo);
long mSecsOld = oldDateTime.Ticks / TimeSpan.TicksPerMillisecond;
long mSecsNew = newDateTime.Ticks / TimeSpan.TicksPerMillisecond;
this.timeOffset = (int)(mSecsNew - mSecsOld);
}
catch (FormatException)
{
}
}
}
public IColumnizedLogLine SplitLine(LogExpert.ILogLineColumnizerCallback callback, ILogLine line)
{
// 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
// 012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
// 03.01.2008 14:48:00.066 <rest of line>
ColumnizedLogLine clogLine = new ColumnizedLogLine();
clogLine.LogLine = line;
Column[] columns = new Column[3]
{
new Column {
FullValue = "", Parent = clogLine
},
new Column {
FullValue = "", Parent = clogLine
},
new Column {
FullValue = "", Parent = clogLine
},
};
clogLine.ColumnValues = columns.Select(a => a as IColumn).ToArray();
string temp = line.FullLine;
FormatInfo formatInfo = _timeFormatDeterminer.DetermineDateTimeFormatInfo(temp);
if (formatInfo == null)
{
columns[2].FullValue = temp;
return(clogLine);
}
int endPos = formatInfo.DateTimeFormat.Length;
int timeLen = formatInfo.TimeFormat.Length;
int dateLen = formatInfo.DateFormat.Length;
try
{
if (this.timeOffset != 0)
{
if (formatInfo.IgnoreFirstChar)
{
// First character is a bracket and should be ignored
DateTime dateTime = DateTime.ParseExact(temp.Substring(1, endPos), formatInfo.DateTimeFormat,
formatInfo.CultureInfo);
dateTime = dateTime.Add(new TimeSpan(0, 0, 0, 0, this.timeOffset));
string newDate = dateTime.ToString(formatInfo.DateTimeFormat, formatInfo.CultureInfo);
columns[0].FullValue = newDate.Substring(0, dateLen); // date
columns[1].FullValue = newDate.Substring(dateLen + 1, timeLen); // time
columns[2].FullValue = temp.Substring(endPos + 2); // rest of line
}
else
{
DateTime dateTime = DateTime.ParseExact(temp.Substring(0, endPos), formatInfo.DateTimeFormat,
formatInfo.CultureInfo);
dateTime = dateTime.Add(new TimeSpan(0, 0, 0, 0, this.timeOffset));
string newDate = dateTime.ToString(formatInfo.DateTimeFormat, formatInfo.CultureInfo);
columns[0].FullValue = newDate.Substring(0, dateLen); // date
columns[1].FullValue = newDate.Substring(dateLen + 1, timeLen); // time
columns[2].FullValue = temp.Substring(endPos); // rest of line
}
}
else
{
if (formatInfo.IgnoreFirstChar)
{
// First character is a bracket and should be ignored
columns[0].FullValue = temp.Substring(1, dateLen); // date
columns[1].FullValue = temp.Substring(dateLen + 2, timeLen); // time
columns[2].FullValue = temp.Substring(endPos + 2); // rest of line
}
else
{
columns[0].FullValue = temp.Substring(0, dateLen); // date
columns[1].FullValue = temp.Substring(dateLen + 1, timeLen); // time
columns[2].FullValue = temp.Substring(endPos); // rest of line
}
}
}
catch (Exception)
{
columns[0].FullValue = "n/a";
columns[1].FullValue = "n/a";
columns[2].FullValue = temp;
}
return(clogLine);
}
public IColumnizedLogLine SplitLine(LogExpert.ILogLineColumnizerCallback callback, ILogLine line)
{
ColumnizedLogLine cLogLine = new ColumnizedLogLine
{
LogLine = line
};
Column[] columns = new Column[8]
{
new Column {
FullValue = "", Parent = cLogLine
},
new Column {
FullValue = "", Parent = cLogLine
},
new Column {
FullValue = "", Parent = cLogLine
},
new Column {
FullValue = "", Parent = cLogLine
},
new Column {
FullValue = "", Parent = cLogLine
},
new Column {
FullValue = "", Parent = cLogLine
},
new Column {
FullValue = "", Parent = cLogLine
},
new Column {
FullValue = "", Parent = cLogLine
}
};
cLogLine.ColumnValues = columns.Select(a => a as IColumn).ToArray();
string temp = line.FullLine;
if (temp.Length > 1024)
{
// spam
temp = temp.Substring(0, 1024);
columns[3].FullValue = temp;
return(cLogLine);
}
// 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
// anon-212-34-174-126.suchen.de - - [08/Mar/2008:00:41:10 +0100] "GET /wiki/index.php?title=Bild:Poster_small.jpg&printable=yes&printable=yes HTTP/1.1" 304 0 "http://www.captain-kloppi.de/wiki/index.php?title=Bild:Poster_small.jpg&printable=yes" "gonzo1[P] +http://www.suchen.de/faq.html"
if (this.lineRegex.IsMatch(temp))
{
Match match = this.lineRegex.Match(temp);
GroupCollection groups = match.Groups;
if (groups.Count == 10)
{
columns[0].FullValue = groups[1].Value;
columns[1].FullValue = groups[3].Value;
columns[3].FullValue = groups[5].Value;
columns[4].FullValue = groups[6].Value;
columns[5].FullValue = groups[7].Value;
columns[6].FullValue = groups[8].Value;
columns[7].FullValue = groups[9].Value;
string dateTimeStr = groups[4].Value.Substring(1, 26);
// dirty probing of date/time format (much faster than DateTime.ParseExact()
if (dateTimeStr[2] == '/' && dateTimeStr[6] == '/' && dateTimeStr[11] == ':')
{
if (this.timeOffset != 0)
{
try
{
DateTime dateTime = DateTime.ParseExact(dateTimeStr, "dd/MMM/yyyy:HH:mm:ss zzz",
new CultureInfo("en-US"));
dateTime = dateTime.Add(new TimeSpan(0, 0, 0, 0, this.timeOffset));
string newDate = dateTime.ToString("dd/MMM/yyyy:HH:mm:ss zzz",
new CultureInfo("en-US"));
columns[2].FullValue = newDate;
}
catch (Exception)
{
columns[2].FullValue = "n/a";
}
}
else
{
columns[2].FullValue = dateTimeStr;
}
}
else
{
columns[2].FullValue = dateTimeStr;
}
}
}
else
{
columns[3].FullValue = temp;
}
return(cLogLine);
}
public IColumnizedLogLine SplitLine(LogExpert.ILogLineColumnizerCallback callback, ILogLine line)
{
// 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
// 012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
// 03.01.2008 14:48:00.066 <rest of line>
ColumnizedLogLine clogLine = new ColumnizedLogLine
{
LogLine = line
};
Column[] columns = new Column[]
{
new Column {
FullValue = "", Parent = clogLine
},
new Column {
FullValue = "", Parent = clogLine
},
new Column {
FullValue = "", Parent = clogLine
},
};
string temp = line.FullLine;
if (temp.Length < 3)
{
columns[2].FullValue = temp;
return(clogLine);
}
FormatInfo formatInfo = _timeFormatDeterminer.DetermineDateTimeFormatInfo(line.FullLine);
if (formatInfo == null)
{
columns[2].FullValue = temp;
SquareSplit(ref columns, temp, 0, 0, 0, clogLine);
}
else
{
int endPos = formatInfo.DateTimeFormat.Length;
int timeLen = formatInfo.TimeFormat.Length;
int dateLen = formatInfo.DateFormat.Length;
try
{
if (this.timeOffset != 0)
{
DateTime dateTime = DateTime.ParseExact(temp.Substring(0, endPos), formatInfo.DateTimeFormat,
formatInfo.CultureInfo);
dateTime = dateTime.Add(new TimeSpan(0, 0, 0, 0, this.timeOffset));
string newDate = dateTime.ToString(formatInfo.DateTimeFormat, formatInfo.CultureInfo);
SquareSplit(ref columns, newDate, dateLen, timeLen, endPos, clogLine);
}
else
{
SquareSplit(ref columns, temp, dateLen, timeLen, endPos, clogLine);
}
}
catch (Exception)
{
columns[0].FullValue = "n/a";
columns[1].FullValue = "n/a";
columns[2].FullValue = temp;
}
}
clogLine.ColumnValues = columns.Select(a => a as IColumn).ToArray();
return(clogLine);
}
private static bool TestFilterMatch(FilterParams filterParams, ILogLine line,
LogExpert.ILogLineColumnizerCallback columnizerCallback)
{
string lowerSearchText;
string searchText;
Regex rex;
if (filterParams.isInRange)
{
lowerSearchText = filterParams.lowerRangeSearchText;
searchText = filterParams.rangeSearchText;
rex = filterParams.rangeRex;
}
else
{
lowerSearchText = filterParams.lowerSearchText;
searchText = filterParams.searchText;
rex = filterParams.rex;
}
if (searchText == null || lowerSearchText == null || searchText.Length == 0)
{
return(false);
}
if (filterParams.columnRestrict)
{
IColumnizedLogLine columns = filterParams.currentColumnizer.SplitLine(columnizerCallback, line);
bool found = false;
foreach (int colIndex in filterParams.columnList)
{
if (colIndex < columns.ColumnValues.Length
) // just to be sure, maybe the columnizer has changed anyhow
{
if (columns.ColumnValues[colIndex].FullValue.Trim().Length == 0)
{
if (filterParams.emptyColumnUsePrev)
{
string prevValue = (string)filterParams.lastNonEmptyCols[colIndex];
if (prevValue != null)
{
if (TestMatchSub(filterParams, prevValue, lowerSearchText, searchText, rex,
filterParams.exactColumnMatch))
{
found = true;
}
}
}
else if (filterParams.emptyColumnHit)
{
return(true);
}
}
else
{
filterParams.lastNonEmptyCols[colIndex] = columns.ColumnValues[colIndex].FullValue;
if (TestMatchSub(filterParams, columns.ColumnValues[colIndex].FullValue, lowerSearchText,
searchText, rex,
filterParams.exactColumnMatch))
{
found = true;
}
}
}
}
return(found);
}
else
{
return(TestMatchSub(filterParams, line.FullLine, lowerSearchText, searchText, rex, false));
}
}