Hello,
I'm struggling to understand how to use mmnormalize module. My
configuration snippet is the following:
template(name="recordRfc3164FileOutput" type="list") {
property(name="timestamp" dateFormat="rfc3164")
constant(value=" ")
property(name="hostname")
constant(value=" "
variables that exist.
my guess is that your rule needs a leading space, because the msg
field you are parsing starts with a space (a very common problem when
you are starting to use mmnormalize)
David Lang
On Tue, 21 May 2024, Adam Cecile via rsyslog wrote:
Date: Tue, 21 May 2024 23:37:14
": { "filename": "", "fileoffset": "3396674" } }
$.:{ "pcc": "t7" }
$/:
On 5/22/24 00:20, David Lang wrote:
if you look at the msg field in the RSYSLOG_DebugFormat output, you
will see that it does have a leading space. your p
you get?
>
>David Lang
>
>On Wed, 22 May 2024, Adam Cecile via rsyslog wrote:
>
>> Date: Wed, 22 May 2024 00:24:08 +0200
>> From: Adam Cecile via rsyslog
>> To: Adam Cecile via rsyslog
>> Cc: Adam Cecile
>> Subject: Re: [rsyslog] Unable to re
about how to re-compose date-time object
from the individual fields, I'd like to hear from you
On 5/22/24 00:38, David Lang wrote:
if you do rsyslogd -N1 does it complain about anything?
David Lang
On Wed, 22 May 2024, Adam Cecile via rsyslog wrote:
Date: Wed, 22 May 2024 00:32:25 +0200
Thanks a lot for your help !
Btw, do you have any suggestion about how to re-compose date-time
object from the individual fields, I'd like to hear from you
On 5/22/24 00:38, David Lang wrote:
if you do rsyslogd -N1 does it complain about anything?
David Lang
On Wed, 22 May 2024, Adam Cecile via
they are inconsistent.
>
>$msg contains [something]-two spaces-[something]-two spaces-something
>
>$rawmsg contains [something]-two spaces-[something]-one space-something
>
>Your pattern contains [something]-one space-[something]-one space-something
>
>On 22.05.2024 00:24, Adam Cec
le directly, did I missed something ?
2. Is there any better way to convert 1 / "01" -> Jan or 12 / "12" ->
Dec than using the static lookup table hack ?
3. Is there any way to localize a my timestamp with server local
timezone ? If so I could use RFC 5424 date-time in
very small
company, a half dozen or fewer people AFAIK)
David Lang
On Wed, 22 May 2024, Adam Cecile via rsyslog wrote:
Date: Wed, 22 May 2024 09:31:49 +0200
From: Adam Cecile via rsyslog
To: rsyslog-users
Cc: Adam Cecile
Subject: Re: [rsyslog] Unable to re-use variable generated by
mmno
9 matches
Mail list logo
