Log Extractors

LogPort uses log extractors to parse log messages from sources that are consumed as plain text and convert them into structured entries. This allows filtering, querying, and aggregation across heterogeneous logs.

Important

It goes without saying, these extractors have a fixed structure. If your log messages change shape, you will need to update their configuration.

Types of Extractors

Regex

Regex extractors use .NET regular expressions to capture structured fields from logs. Below are the required fields for a Regex extractor to work

Field	Description
ServiceName	The service or application this extractor applies to
ExtractionMode	Set to "regex" for regex-based extractors
Pattern	A .NET regex pattern with named groups for timestamp, level, and message
TimestampGroup	Name of the group capturing the timestamp
LevelGroup	Name of the group capturing the log level
MessageGroup	Name of the group capturing the log message

Example Usage

Log Line

[12:34:56 Info] Application started successfully

Valid Extractor

"Extractors": [
  {
    "ServiceName": "my-service",
    "ExtractionMode": "regex",
    "Pattern": "\\[(?<timestamp>\\d{2}:\\d{2}:\\d{2})\\s+(?<loglevel>[^\\]]+)\\]\\s+(?<message>.+)",
    "TimestampGroup": "timestamp",
    "LevelGroup": "loglevel",
    "MessageGroup": "message"
  }
]

JSON

JSON extractors parse logs that are already structured as JSON objects, allowing LogPort to read fields directly without using regex.

Field	Description
ServiceName	The service or application this extractor applies to
ExtractionMode	Set to "json" for JSON-based extraction
TimestampProperty	Name of the JSON property containing the timestamp
LevelProperty	Name of the JSON property containing the log level
MessageProperty	Name of the JSON property containing the log message

Note

JSON Extractors only work if the json object is contained in a single line. If it contains line breaks it will not work.

Example

Json Message

{ "time": "12:34:56", "level": "Info", "message": "Application started successfully" }

Extractor

"Extractors": [
  {
    "ServiceName": "my-service",
    "ExtractionMode": "json",
    "TimestampProperty": "time",
    "LevelProperty": "level",
    "MessageProperty": "message"
  }
]