I think this was probably a doc bug from day one on (or heavily outdated). It is supported, and we do it in several cases.
I'll update the doc later today. Rainer El vie, 4 jun 2021 a las 7:46, rajeshksv via rsyslog (<[email protected]>) escribió: > > In this scenario, we can't combine them as the first call comes default > from the custom package (over rsyslog) users install. Other calls might be > added by users who install the custom package. Users might have multiple > mmnormalize calls as well > > If docs are outdated and we can use mmnormalize multiple times, then > awesome it is! > > On Thu, Jun 3, 2021 at 11:19 AM David Lang <[email protected]> wrote: > > > I have used multiple mmnormalize calls on the same message without a > > problem. > > > > That being said, if you can combine your rulesets, it's going to be more > > effiecient than having to make multiple calls. > > > > I believe the note in the docs is out of date. > > > > David Lang > > > > On Thu, 3 Jun 2021, rajeshksv via rsyslog wrote: > > > > > Date: Thu, 3 Jun 2021 10:48:15 +0530 > > > From: rajeshksv via rsyslog <[email protected]> > > > To: rsyslog-users <[email protected]> > > > Cc: rajeshksv <[email protected]> > > > Subject: [rsyslog] Multiple mmnormalize calls on same message > > > > > > Hi Rsyslog Team, > > > > > > We are planning to call mmnormalize multiple times for a message, > > > > > > action(type="mmnormalize" > > > ruleBase="/etc/rsyslog.d/container_log_parse.rulebase" > > path="$!parsedmsg") > > > set $!msg = $!parsedmsg!log; > > > ....... > > > ....... > > > action(type="mmnormalize" rule=["rule=:%severity:word% %message:rest%"] > > > path="$!normalized_msg" variable="$!msg") > > > > > > We found that, its working perfectly fine. However in docs > > > < > > https://www.rsyslog.com/doc/v8-stable/configuration/modules/mmnormalize.html > > >, > > > it says > > > "Note that mmnormalize should only be called once on each message. > > > Behaviour is undefined if multiple calls to mmnormalize happen for the > > same > > > message." > > > > > > Couldn't understand completely what the statement means and the reasoning > > > behind it. Can we use mmnormalize like above or we should replace one of > > > mmnormalize functionality with other functions ? (we are using first > > > mmnormalize to split the message into multiple fields using space > > > delimiter. So, we can use re_extract function or property replacers or > > some > > > other function) > > > > > > > > > > > -- > Regards, > Rajesh KSV > _______________________________________________ > rsyslog mailing list > https://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > LIKE THAT. _______________________________________________ rsyslog mailing list https://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
