topic Re: Regex for Log source in Log Analytics

Regex for custom log source

Shal — Thu, 18 Dec 2025 09:37:40 GMT

Hi Team,

I am trying to add below log file in Custom log source

D:\xxx\Apps\BusSys_UAT_OC5\xxx.BLT.BulkImportServerWS\2025.4.24.1-mainBulkLoadTool-OC5\logs\2025-04-24\log.txt

The words highlighted in red change according to the date the folder and file are generated.

Can someone suggest how I can add a custom log for this pattern?

I tried ones below

D:\xxx\Apps\BusSys_UAT_OC5\xxx.BLT.BulkImportServerWS
\2025.4.24.1-mainBulkLoadTool-OC5\logs\*\log*
D:\xxx\Apps\BusSys_UAT_OC5\xxx\
2025.4.24.1-mainBulkLoadTool-OC5\logs\xxx\*.txt
D:\xxx\Apps\BusSys_UAT_OC5\xxx.BLT.BulkImportServerWS\
*\logs\*\*.txt

It either shows No log data or the file does not exist.

Re: Regex for Log source

Joachim_Erdei — Tue, 29 Apr 2025 13:15:34 GMT

Hi Shal,

the last one looks OK. (You can think of it as patterns for searching files on disk.) Have you created an ingest rule to ingest this custom log source?

Re: Regex for Log source

Shal — Thu, 26 Jun 2025 13:13:38 GMT

Hi Joachim,

Yes I have added custom log source as well as log ingestion rule as below:

Log source is any of : D:\XXX\Apps\BusSys_UAT_OC5\xxxBLT.BulkImportServerWS\*\logs\*\*.txt

Thanks

Re: Regex for Log source

Joachim_Erdei — Wed, 30 Apr 2025 06:40:40 GMT

Hi Shal,

just to be clear, is "xxx" in your paths a replacement for something sensitive, or a part that might have multiple values (like a wildcard)? If taken literally, please note that you log ingest rule covers the second of custom log sources in the first post, and the rest are not matched (Merchants vs xxx).

Can you say what is the exact full path to the log file you try to ingest? Knowing that I could match it with the rules.

Re: Regex for Log source

Shal — Thu, 26 Jun 2025 13:14:36 GMT

Hi Joachim,

Yes, sorry for the confusion. You can consider the actual file path as below:

D:\xxx\Apps\BusSys_UAT_OC5\xxx.BLT.BulkImportServerWS\2025.4.24.1-mainBulkLoadTool-OC5\logs\2025-04-24\log.txt

The text highlighted in red generates based on date . Sometimes instead of log.txt there can be files like log.00001.txt or log.00002.txt also.

That is the reason am considering it as wildcards and added the below rule .

Just checking if the custom log source and rule can be added as below so that if there is any recent file it can capture it.

D:\xxxApps\BusSys_UAT_OC5\xxxBLT.BulkImportServerWS\*\logs\*\*.txt

Thanks!

Re: Regex for Log source

Joachim_Erdei — Mon, 05 May 2025 07:17:12 GMT

It looks to me that the custom log source rule is perfectly OK. Please remember that custom log source name (not the file name) is your "log.source" attribute, which you can choose in your ingest rules.

Just for your information - you should also have a built-in rule (disabled on default) which ingests all custom log sources - you can just enable it if you find it suitable.