Search By Category

Can OR conditions be specified for search strings in log monitoring?

Yes, log monitoring search strings can be specified with OR conditions.

Specification methods differ depending on the plugin used, so be sure to go over the information below as well as the plugin’s README.

check-log（ README）

The following options let you specify OR conditions using regular expressions.

  • --pattern
  • --exclude
# If ERROR or FATAL are included, demarcate with “I” pipe
[plugin.checks.ex1]
command = ["check-log", "-f", "/path/to/log", "--pattern", "ERROR|FATAL", ...]

check-windows-eventlog（ README）

The following options let you specify OR conditions using regular expressions.

  • --message-pattern
  • --message-exclude
  • --source-pattern
  • --source-exclude
# If ERROR or FATAL are included, demarcate with pipe character "|"
[plugin.checks.ex2]
command = ["check-windows-eventlog", "--type", "Error", "--message-pattern", "ERROR|FATAL", ...]

check-aws-cloudwatch-logs（ README）

The following options let you specify OR conditions using the filter and pattern syntax of AWS CloudWatch Logs .

  • --pattern
# If ERROR or FATAL are included, add a "?" question mark
[plugin.checks.ex3]
command = ["check-aws-cloudwatch-logs", "--log-group-name", "/log/group/name", "--pattern", "?ERROR ?FATAL", ...]

Related articles