I have used multiple mmnormalize calls on the same message without a problem.
That being said, if you can combine your rulesets, it's going to be more effiecient than having to make multiple calls.
I believe the note in the docs is out of date. David Lang On Thu, 3 Jun 2021, rajeshksv via rsyslog wrote:
Date: Thu, 3 Jun 2021 10:48:15 +0530 From: rajeshksv via rsyslog <[email protected]> To: rsyslog-users <[email protected]> Cc: rajeshksv <[email protected]> Subject: [rsyslog] Multiple mmnormalize calls on same message Hi Rsyslog Team, We are planning to call mmnormalize multiple times for a message, action(type="mmnormalize" ruleBase="/etc/rsyslog.d/container_log_parse.rulebase" path="$!parsedmsg") set $!msg = $!parsedmsg!log; ....... ....... action(type="mmnormalize" rule=["rule=:%severity:word% %message:rest%"] path="$!normalized_msg" variable="$!msg") We found that, its working perfectly fine. However in docs <https://www.rsyslog.com/doc/v8-stable/configuration/modules/mmnormalize.html>, it says "Note that mmnormalize should only be called once on each message. Behaviour is undefined if multiple calls to mmnormalize happen for the same message." Couldn't understand completely what the statement means and the reasoning behind it. Can we use mmnormalize like above or we should replace one of mmnormalize functionality with other functions ? (we are using first mmnormalize to split the message into multiple fields using space delimiter. So, we can use re_extract function or property replacers or some other function)
_______________________________________________ rsyslog mailing list https://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
