Hi Rsyslog Team, We are planning to call mmnormalize multiple times for a message,
action(type="mmnormalize" ruleBase="/etc/rsyslog.d/container_log_parse.rulebase" path="$!parsedmsg") set $!msg = $!parsedmsg!log; ....... ....... action(type="mmnormalize" rule=["rule=:%severity:word% %message:rest%"] path="$!normalized_msg" variable="$!msg") We found that, its working perfectly fine. However in docs <https://www.rsyslog.com/doc/v8-stable/configuration/modules/mmnormalize.html>, it says "Note that mmnormalize should only be called once on each message. Behaviour is undefined if multiple calls to mmnormalize happen for the same message." Couldn't understand completely what the statement means and the reasoning behind it. Can we use mmnormalize like above or we should replace one of mmnormalize functionality with other functions ? (we are using first mmnormalize to split the message into multiple fields using space delimiter. So, we can use re_extract function or property replacers or some other function) -- Regards, Rajesh KSV _______________________________________________ rsyslog mailing list https://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
