On Fri, 27 Dec 2019, kyparisisg via rsyslog wrote:
I use mmnormalize to parse log messages. When the parsing is done and I confirm that the rules create the desired fields, I want to modify one of the fields and replace or remove some of the data that exist on that internally generated property-variable. I use jsonparse and then mmnormalize to do the parsing. I am trying to access the property generated from mmnormalize by using $!field_name but for some reason I am unable to modify the value, or I cannot even use some function that are listed on RainerScript. Could you please help me figure out how to modify a parse log field?
you would use the set function to change the value, please show an example of what you are doing.
David Lang _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
