Just noticed that my template was mangled somehow.
Here it is again:
$template test_template,"%timestamp% %programname%
%msg:R,ERE,1,FIELD:(.*)text_to_replace.--end%
text_to_replace_with
%msg:R,ERE,1,FIELD:.text_to_replace(.*)--end%"
In between each pair of parentheses ( ) should be .* (dot star)
another tip:
In a similar situation, I discovered that rsyslog wasn't parsing the
message as I had expected. I used an output template with '%json%'
which output the entire message after it had been parsed. This led me
to the solution - i was looking at the wrong field.
Hope this helps.
Dan Pritts
ICPSR Computing and Network Services
On 21 Jan 2020, at 11:11, Patrick Peter via rsyslog wrote:
Hello Danno
Thank you, the mentioned rules works but only when i pass the string
via
logger.
How can i use it ruleset?
Thanks.
--
Sent from: http://rsyslog-users.1305293.n2.nabble.com/
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST
if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
