I'm not entirely sure what you mean, but based on your configuration...
rsyslog is not going to modify the log file it is reading from.
If you want to debug locally, use the template in a rule that logs to a
file.
Dan Pritts
ICPSR Computing and Network Services
On 24 Jan 2020, at 4:36, Patrick Peter via rsyslog wrote:
Hello Danno
Thank you for helping, I am able to replace the text i want with
configs you
suggested.
But while using within a ruleset, it does not replace in the log file
which
is being written by the application.
Could you please help me in sorting this out?
Below is how i am doing it, please correct me. ruleset will have other
parameters to send the logs to a target server, but right now i am
just
trying to make it work locally and later i will mention the target and
other
parameters.
$template test_template,"%PRI% %timestamp%
%programname%%msg:R,ERE,1,FIELD:(.*)text_to_replace/.*--end%
text_to_replace_wtih %msg:R,ERE,1,FIELD:.*text_to_replace(.*)--end%\n"
ruleset(name="sendToLocal") {
:msg, contains, "text_to_replace" stop
action(type="omfwd" Template="test_template")
}
input(type="imfile"
File="/path/to/my/logfile.log"
maxSubmitAtOnce="2048"
escapelf="on"
Tag="Tag_Name"
startmsg.regex="^[[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2}
[[:digit:]]{2}:[[:digit:]]{2}:[[:digit:]]{2},[[:digit:]]{3} "
Severity="info"
Ruleset="sendToLocal")
Thanks & Regards,
Pat
--
Sent from: http://rsyslog-users.1305293.n2.nabble.com/
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST
if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
