Parse Audit file


(Serak Shiferaw) #1

Hi All i wanted a specif patter of filter and i cant get my head arround it because my columns are not uniform

for example i have line like
Format
TimeStamp || BusinessTimeStamp ||RuntimeMicroflowID ||MicroflowID ||UserId ||ClientId ||Userlocation ||Transactionid ||Catagorie ||EventType ||Operation ||PrimaryData ||SecondayData || < Other Data >

then comes the tricky part the first 13 columns are fixed values always ... the other < Other Data > part is KEY || OLDVALUE || NEWVALUE , ..... this pattern repeats with every 3 column

in java this is what i did

        for (int i = 13; i < column.length; i += 3) {
                            System.out.println(column[i]+ column[(i + 1)]+column[(i + 2)]);
                        }

Sample Data
1.
2017.10.31/08:03:28.542||2017.10.31/08:03:28.542||'015f70cfa0b11VKG%27059'||'CB_CMN_ReadCurrency_SRV'||'alemugem'||'UXP'||'00001015'||''||'MicroFlow'||'Finished'||''||''||''||'CurrentThread'||'WebContainer : 23'||''||'ParentThread'||'system'||''
2.
2017.10.31/08:09:26.405||2017.10.31/08:09:26.405||'015f70d5944e2RO0%43399'||'ApproveReferral'||'shambelg'||'UXP'||'00001028'||'015f70d594cf2RP3'||'Persistence'||''||'CREATE'||'Task'||'015f70d594d72RP9'||'CurrentThread'||'WebContainer : 6'||''||'ParentThread'||'system'||''||'versionNum'||'0'||''||'f_MICROFLOWID'||'ApproveReferral'||''||'f_RUNTIMEMICROFLOWID'||'015f70d5944e2RO0%43399'||''||'f_ZONE'||'BF'||''||'f_STATUS'||'Open'||''||'f_PAYLOAD'||$BLOB_015f70d595052RPf||''||'f_ORIGINALTASKID'||''||''||'f_BUSINESSMFNAME'||''||''||'f_ALLCOMMENTS'||'; Supervisor authorization required for Creating Account Alerts'||''||'f_RAISEDAT'||'2017-10-31 08:09:26.358'||''||'f_TYPE'||'Approval'||''||'f_CHANNELTYPE'||'UXP'||''||'f_ALERTAT'||'2017-10-31 09:09:26.358'||''||'f_COMMENT'||''||''||'f_TASKLISTID'||'015f70ca8a4c0y4I'||''||'f_PROCESSEDAT'||'2017-10-31 08:09:26.358'||''||'f_ALERTTASKNAME'||''||''||'f_RAISEDBY'||'shambelg'||''||'f_DETAILS'||$BLOB_015f70d595052RPg||''||'f_PROCESSEDBY'||''||''||'f_TASKNAME'||'business.approval'||''

Regards
Serak


(system) #2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.