changing previous entry after it is added

Here developers can talk about how to write a Parser for LogMX

Moderator: admin

Post Reply
jpierce
Posts: 51
Joined: Thu Mar 21, 2019 3:51 pm

changing previous entry after it is added

Post by jpierce »

I have a question about what kind of thing is considered allowable when dealing with entries that have already been added. There is a slight annoyance in that our logs in that there is a possibility of lines getting written out of timestamp order in rare cases. For the rare instance, I might want to fudge them to change the date on them. There's also the fact that we (sadly) don't write the year on each line. I might find the year later in the file, though. I might also find some time zone offset information, allowing me to figure out the UTC time.

As such, I wonder if it's okay to go back and call setDate() on entries that have already been added with addEntry()? I can think of other situations where this might be useful to add something to the message field of certain entries as well.

Once you call addEntry(), should that entry be considered untouchable?
admin
Site Admin
Posts: 555
Joined: Sun Dec 17, 2006 10:30 pm

Re: changing previous entry after it is added

Post by admin »

Hello,

You can call "addEntry()" multiple times for the same entry (for example if you discover more content belonging for this entry on the next lines), but as soon as you call "addEntry()" for another entry, you shall not call it for the previous one. This is because when using AutoRefresh with filters, these filters are evaluated only once for each log entry, for performance reason.

But if you don't plan using AutoRefresh, you can try doing so, but it's not something we support (never tested). Also, about the Time field, LogMX doesn't automatically sort log entries by Time (unless you click on the Time column to manually sort them). So entries order will not change if you try to change the date on an entry later on through "addEntry()".

Technically speaking, nothing will prevent you from doing all of that (well, you'll still have to remember all the previous entries for that), but some features in LogMX may not work as expected if you do so. So I would say you can try and see if it works for you.

Xavier
jpierce
Posts: 51
Joined: Thu Mar 21, 2019 3:51 pm

Re: changing previous entry after it is added

Post by jpierce »

In my case, we have a log that is processed by another application, which puts a line at the top of the log with the timestamp for when it processed it. This will therefore be later than the other timestamps and so the log will be out of order (and, in fact, potentially have a timestamp that's way ahead of the others and will thus make the timeline display an area that it really doesn't need to).

I've decided I'm just going to throw those out, though. They're really not that informational. But I figured it the question might be applicable to some other stuff as well. Annoyingly enough, the log doesn't start out with the full time zone, so that's also something we might want to go back and revise. But it probably won't do any good if I can only go back and edit one entry.

Will just have to consider my options.
Post Reply