Regex matching issue (white space)

Open villqrd opened this issue 6 months ago • 1 comments

lnav version v0.12.4 is the latest

Describe the bug Regex won't match properly when there is a white space

To Reproduce See regex here:

https://regex101.com/r/wgFTDg/1

It works fine in both case:

with space before after and before first pipe |
without space before after and before first pipe |

using lnav and the corresponding pattern:

{
    "$schema": "https://lnav.org/schemas/format-v1.schema.json",
    "anifront": {
        "multiline": false,
        "regex": {
            "std": {
                "pattern": "^(?<instance>.*)\\|\\s*(?<timestamp>\\d{4}-\\d{2}-\\d{2} \\d{2}:\\d{2}:\\d{2}\\.\\d{3})\\s+\\|\\s+(?<level>\\w+)\\s+\\|\\s*(?<username>\\w+)\\s*\\|\\s+(?<body>.*)"
            }
        },
        "timestamp-format": [
            "%Y-%m-%d %H:%M:%S.%L"
        ],
        "level": {
            "error": "ERROR",
            "info": "INFO",
            "debug": "DEBUG",
            "warning": "WARNING",
            "critical": "CRITICAL",
            "trace": "TRACE"
        },
        "value": {
            "username": {
                "kind": "string",
                "identifier": true
            },
            "instance": {
                "kind": "string",
                "identifier": true
            },
            "level": {
                "kind": "string"
            },
            "timestamp": {
                "kind": "string"
            }
        },
        "sample": [
            {
                "line": "i106mylauki7d@vps-c3a9d092 | 2025-07-27 18:15:36.960 | DEBUG    |u1| Body1"
            },
            {
                "line": "i3@vps-c3a9d092| 2025-07-27 19:15:36.960 | DEBUG    |u2| Body2"
            }
        ]
    }
}

the format installs well, but it fails to match the following test file:

i106mylauki7d@vps-c3a9d092 | 2025-07-27 18:15:36.960 | DEBUG    |u1| Body1
i106mylauki7d@vps-c3a9d092 | 2025-07-27 18:15:36.960 | DEBUG    |u1| Body1

It matches however if there is only one line in the test file:

i106mylauki7d@vps-c3a9d092 | 2025-07-27 18:15:36.960 | DEBUG    |u1| Body1

of if there is no space:

i106mylauki7d@vps-c3a9d092| 2025-07-27 18:15:36.960 | DEBUG    |u1| Body1
i106mylauki7d@vps-c3a9d092| 2025-07-27 18:15:36.960 | DEBUG    |u1| Body1

How come? Is this a bug or am I missing something about matching?

Thanks

Jul 29 '25 12:07 villqrd

When I load the example file in v0.13.0, it's being matched by the "container" demultiplexer. The demuxer splits a single input into multiple files based off of an instance ID (e.g. a docker container name). You can press TAB to focus on the "Files" configuration tab and get details on why lnav is doing what it is doing. Here's what I see:

It kinda looks like the first column in your logs is a machine identifier as well, is that right?

The demultiplexing feature kinda works around a limitation in lnav where it can only handle a single format per file. Since containers tend to have different output formats, splitting the input into separate files allows lnav to properly detect each container's log format since the demux identifier is stripped and only the body of the message is put in the files.

If you want to disable the demultiplexer, you can run the following:

:config /log/demux/container/enabled false

Aug 03 '25 18:08 tstack