In this scenario, we can't combine them as the first call comes default from the custom package (over rsyslog) users install. Other calls might be added by users who install the custom package. Users might have multiple mmnormalize calls as well
If docs are outdated and we can use mmnormalize multiple times, then awesome it is! On Thu, Jun 3, 2021 at 11:19 AM David Lang <[email protected]> wrote: > I have used multiple mmnormalize calls on the same message without a > problem. > > That being said, if you can combine your rulesets, it's going to be more > effiecient than having to make multiple calls. > > I believe the note in the docs is out of date. > > David Lang > > On Thu, 3 Jun 2021, rajeshksv via rsyslog wrote: > > > Date: Thu, 3 Jun 2021 10:48:15 +0530 > > From: rajeshksv via rsyslog <[email protected]> > > To: rsyslog-users <[email protected]> > > Cc: rajeshksv <[email protected]> > > Subject: [rsyslog] Multiple mmnormalize calls on same message > > > > Hi Rsyslog Team, > > > > We are planning to call mmnormalize multiple times for a message, > > > > action(type="mmnormalize" > > ruleBase="/etc/rsyslog.d/container_log_parse.rulebase" > path="$!parsedmsg") > > set $!msg = $!parsedmsg!log; > > ....... > > ....... > > action(type="mmnormalize" rule=["rule=:%severity:word% %message:rest%"] > > path="$!normalized_msg" variable="$!msg") > > > > We found that, its working perfectly fine. However in docs > > < > https://www.rsyslog.com/doc/v8-stable/configuration/modules/mmnormalize.html > >, > > it says > > "Note that mmnormalize should only be called once on each message. > > Behaviour is undefined if multiple calls to mmnormalize happen for the > same > > message." > > > > Couldn't understand completely what the statement means and the reasoning > > behind it. Can we use mmnormalize like above or we should replace one of > > mmnormalize functionality with other functions ? (we are using first > > mmnormalize to split the message into multiple fields using space > > delimiter. So, we can use re_extract function or property replacers or > some > > other function) > > > > > -- Regards, Rajesh KSV _______________________________________________ rsyslog mailing list https://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
