I have data blocks being sent to a SQL Server 2017 table - for purposes of minimally-reproducible example, let's say each of the data blocks look something like this:
2:32:34 PM #0 Info Entering agent monitor.
2:32:34 PM #1 Info Agent
2:32:34 PM #1 Warning Error: the pages could not be loaded...
2:32:34 PM #1 Alert Setting user
2:32:34 PM #2 Warning Loading data.
2:32:34 PM #2 Info Setting first browser proxy. Proxy is None
2:32:34 PM #3 Error One or more threads threw Error #123
2:32:35 PM #3 Info Loading Data
That's the format the data is getting written to the field in. The actual data blocks are much larger than this, but the important bit to note is the line containing the status Error (line 7).
As opposed to inserting the entirety of the data block to a field called DataText, I only want to insert the Error line, and without the leading timestamp or # (i.e. the value of the DataText field for the above would be Error One or more threads threw Error #123. Note that other "Error" message on the third line (actually only considered a warning for our purposes). We do NOT want to pick this up. Only where the actual status is "Error."
With my limited time in SQL, I feel I need to go for some combination of SUBSTRING and maybe PATINDEX? I'm having a little trouble with this one.
This is what I have so far:
CREATE TRIGGER [dbo].[LogParseTrigger]
ON [dbo].[Logs]
INSTEAD OF INSERT
AS
BEGIN
SET NOCOUNT ON
INSERT INTO dbo.Logs (Id, DataText)
SELECT
i.Id, j.DataText
FROM
Inserted i
OUTER APPLY
(SELECT
CAST(SUBSTRING(SUBSTRING(i.DataText, PATINDEX('%#[0-9] Error%', i.DataText), 999), 1, PATINDEX('%???%', SUBSTRING(i.DataText, PATINDEX('%???%', i.DataText), 999) + 'x') - 1) AS nvarchar) AS [DataText]
FROM
Inserted i) j
END
Note the question marks in the 2nd and 3rd instances of PATINDEX - this is where I'm getting totally lost. Am I even on the right track?
Any suggestions, even if it's a different approach from Substring/PatIndex, would be greatly appreciated.
EDIT #1
It's important to note, with regard to the finding the end of the pattern, it is possible that the error message could extend to a new line. But it would never contain a full timestamp within the error message that we need to capture.