NXLOG how to merge multilines regex

Question

I have a log like this:

14:40:33.476 [WebContainer : 149] sometihng sometihng 
14:40:33.476 [WebContainer : 149] sometihng sometihng 
14:40:33.476 [WebContainer : 149] sometihng sometihng 
14:40:33.476 [WebContainer : 245] csometihng sometihng 
14:40:33.476 [WebContainer : 245] sometihng sometihng 
14:40:33.476 [WebContainer : 245] sometihng sometihng

I use nxlog to send this to kafka, what I want is to merge all lines with "WebContainer : 149" into one, and next line when this changes and so on.

Answer 1

You can use the following regex to capture all the lines with a certain value:

/(.*\[WebContainer : (\d+)\]\s*(.*))+\s+.*\[WebContainer : \2\]\s(.*)+\s+.*\[WebContainer : \2\]\s(.*)+/g

The regex matches any number of any char up to '[WebContainer : ', then matches any number and a right Square bracket before matcing White Spaces.

Then it starts all over Again (a new line), only here it uses capturing Group 2 to specify the number. This is repeated on the third line.

Then replace the matches with :

$1$3$4

Now you will get one line per number, combining the 'sometihng' from each line.