Hi @Thierry Vernhet Do you have more examples from your HDFS records? 🙂 I made a simple test here, and its seems to be working your REGEX with the Uppercase Here's the output CREATE EXTERNAL TABLE my_arming_table
( dc_syslog_date STRING,
dc_syslog_hostname STRING,
dc_syslog_process STRING,
dc_logtype STRING,
dc_message STRING)
PARTITIONED BY (yearbrut INT, monthbrut INT, daybrut INT)
ROW FORMAT SERDE 'org.apache.hadoop.hive.serde2.RegexSerDe'
WITH SERDEPROPERTIES( 'input.regex'='^(\\S+)\\s(\\S+)\\s(\\S+)\\s(ARMING)\\s(.*)') STORED AS TEXTFILE
LOCATION '/user/hive/warehouse/my_arming_table/';
ALTER TABLE my_arming_table ADD PARTITION(yearbrut=2018,monthbrut=06,daybrut=06);
#Command to put some data in the table hdfs dfs -put regex_hcc /user/hive/warehouse/my_arming_table/yearbrut=2018/monthbrut=6/daybrut=6/
#And here's a quick describe from my tablehive> desc formatted my_arming_table;
OK
# col_name data_type comment
dc_syslog_date string
dc_syslog_hostname string
dc_syslog_process string
dc_logtype string
dc_message string
# Partition Information
# col_name data_type comment
yearbrut int
monthbrut int
daybrut int
# Detailed Table Information
Database: default
Owner: hive
CreateTime: Wed Jun 06 18:00:02 UTC 2018
LastAccessTime: UNKNOWN
Protect Mode: None
Retention: 0
Location: hdfs://vini-horton/user/hive/warehouse/my_arming_table
Table Type: EXTERNAL_TABLE
Table Parameters:
EXTERNAL TRUE
transient_lastDdlTime 1528308002
# Storage Information
SerDe Library: org.apache.hadoop.hive.serde2.RegexSerDe
InputFormat: org.apache.hadoop.mapred.TextInputFormat
OutputFormat: org.apache.hadoop.hive.ql.io.HiveIgnoreKeyTextOutputFormat
Compressed: No
Num Buckets: -1
Bucket Columns: []
Sort Columns: []
Storage Desc Params:
input.regex ^(\\S+)\\s(\\S+)\\s(\\S+)\\s(ARMING)\\s(.*)
serialization.format 1
#Finally the select outputhive>select * from my_arming_table;
OK
2018-06-06T11:28:54+02:00 sazqye named[980]: ARMING trigger on (action:LOG) (T6-Recursive-attacks recursive-time: 1283) 2018 6 6
NULL NULL NULL NULL NULL 2018 6 6
Time taken: 0.175 seconds, Fetched: 2 row(s)
... View more
