Need help Parsing application error messages

[RSAAdmin]

I am trying to parse messages from an application so I can gather statistics on some errors in a Windows Application Event log. See a partial raw log message below.

2011/02/28 09:09:46.007 CST 192.168.252.246 %NICWIN-4-Application_1309_ASP.NET: Application,rn=11280 cid=0x00000003 eid=0x8000051d,Mon Feb 28 08:55:18 2011,1309,ASP.NET 2.0.50727.0,None,Warning,VMR2BUSUNIT,No category string found,,No description string found. string-data=[3005 <~> An unhandled exception has occurred.

Since this is a custom application, Envision cannot parse the log message. What is the best way to add this using ESI? Using only the first part of the message as the message ID fails. It looks like I am going to have to create multiple message ID's, one for each application error. Am I correct or is there an easier way?

I tried to use "NICWIN-4-Application" as the message ID instead of the whole string (NICWIN-4-Application_1309_ASP.NET) , because there are also 1316, 1301, 1315, etc error messages that I want to include in a general query. Basically, I want all "Application" error messages in one report. I may want to segment them at a later date but for now, the report should include them all. You can see that the 1309 is listed twice. Could I use the second instance as the message ID?

[RSAAdmin]

if the format and text  of each error message changes then you want to have different message definitions for different error messages. in that case NICWIN-4-Application_1309_ASP.NET shall be your message ID on the look of it... you can post some more error mesages on the post for us to have a look at.

[RobertWengewicz]

Since the 1309 in %NICWIN-4-Application_1309_ASP.NET is your message ID and that part of the log is all that changes then all you need a header like this as long as _ASP.NET stays the same(XXXX_ASP.NET). Then yes you need to just have a message for each of those numbers

(1316, 1301, 1315, etc). And then the Message ID will be just the number. If the logs pretty much has the same data in them you can make one message and then just copy and paste, then just change the Message ID.

 <HEADER id1="0001" id2="0001" content="%NICWIN-4-Application_<messageid>:<!payload>" />

 <MESSAGElevel="2"parse="1"parsedefvalue="1"tableid="1"id1="1309"id2="1309_ASP.NET"eventcategory="1901000000"content="<fld1>Application,<fld2>,<fld3>,<fld4>,<fld5>,<fld6>,<fld7>,<fld8>,<fld9>,,<fld10>"/>

Hope this may helps

Bob W