What is LogParser?
It was written by Alois Kraus http://geekswithblogs.net/akraus1/Default.aspx as pet project.

When you have used the Enterprise Library Logging Application Block you will have tried out to log to a file. This part is managed by the listeners (rolling-/file and event log) in combination with a formatter. Normally you configure the output format with a TextFormatter where you use a message template like this:

Timestamp: {timestamp}
Message: {message}
Category: {category}
Priority: {priority}
EventId: {eventid}
Severity: {severity}
Machine: {machine}
Application Domain: {appDomain}
Process Id: {processId}
Process Name: {processName}

The output format is therefore arbitrary and is not easy to parse in a general way if you want to process your log files in an automated way. You can carve the output format to stone and live with it. Another way is create from the message template a regular expression and use this expression/s to parse the log file/s. Now you can change the output format as often as you want without the need to change your log file processing tools after every template change since the parser does automatically adapt itself to the new log format.

To parse a log file and filter for some specific entries is now very easy:
using EnterpriseLibraryContrib.Logging.Parser;

        public void ParseRollingFile()

            FilteredLogFileReader reader = new FilteredLogFileReader("trace.log", "Logging.config");

            Filter filter = new Filter();
            filter.StopTime = DateTime.MinValue;

             foreach (LogEntry entry in reader.ParseLogFile(filter))
                    Console.WriteLine("Got message: {0}, Date: {1}", entry.Message, entry.TimeStamp);


You only need the log file name and the used Enterprise Library Logging configuration file to get the interesting messages out of your log file.

Linq 2 Log File
Language Integrated Queries which will arrive with Visual Studio Orcas will make it even easier to query your log files. The hard lifting is done by the parser and you only have to define the filter query for the events you are interested in:
using System;
using System.Linq;
using EnterpriseLibraryContrib.Logging.Parser;

namespace LinqToLogFile

    class Program

        public const string SampleConfigFile = "loggingtest.config";
        const string TraceLog = "trace.log";

        static void Main(string[] args)

            // Create Parser from Logging configuration for this log file
            FilteredLogFileReader reader = new FilteredLogFileReader(TraceLog, SampleConfigFile);

            // select all messages which contain Hello in the message text
            var Messages =
                from entry in reader
                where entry.Message.Contains("Hello")
                select entry;

            Console.WriteLine("Messages in Log File which contain Hello:");

            // print the matching messages out
            foreach (var msg in Messages)




Current Status
File parsing does work already. I plan to add also a eventlog reader to enable easy processing of log data.

Alois Kraus

Last edited Dec 15, 2009 at 12:17 PM by ewdev, version 7


No comments yet.