Hi, There is a parsedate() function, but that probably won't be able to parse this format. On the other hand it should be possible to do it with strptime() as in this example: http://nxlog.org/nxlog-docs/en/nxlog-reference-manual.html#idp9012752
Note that you should use a captured reference in your regular expression using (). Regards, Botond On Wed, 28 Aug 2013 11:07:48 +0200 Aurélien BOUVARD <[email protected]> wrote: > Hi, > On my syslog server , i saw that i can't receive "timereported" value (date > in syslog message header) so my syslog server replace it by a "timegenerated" > , which is the date i'm receiving the logs. > So i'm trying to extract the syslog header date, store it in "EventTime" > Field , and after send it on my server. > I also try to use " Exec EeventTime = now (); but of course it give me the > date of receiving on the client , not the syslog header date. > I have this kind of multiline message > > Tue Aug 20 13:13:36 2013[1952] Successfully onlined Undo Tablespace 2.Undo > initialization finished serial:0 start:161008 end:163988 diff:2980 (29 > seconds)Verifying file header compatibility for 11g tablespace > encryption..Verifying 11g file header compatibility for tablespace encryption > completedSMON: enabling tx recoveryDatabase Characterset is AL32UTF8Opening > with Resource Manager plan: INTERNAL_PLAN_XE > > so , i try to do this : > > > > Exec if ( $Message =~ /^\w\w\w\s\w\w\w\s\d\d\s\d\d:\d\d:\d\d\s\d\d\d\d/ ) \{ > \$EventTime = ??????} > i don't know what i can write there to take something corresponding to my > regex I also thank to "extract all characters from the first line and put it > in $EventTime" but it dosen't work ( i used split, trim...) > > of course , after that , i use "Exec to_syslog_ietf();" to receive good logs. > Any idea or suggestion? > > > ------------------------------------------------------------------------------------------------------------------------------------------ > > ------------------------------------------------------------------------------ Learn the latest--Visual Studio 2012, SharePoint 2013, SQL 2012, more! Discover the easy way to master current and previous Microsoft technologies and advance your career. Get an incredible 1,500+ hours of step-by-step tutorial videos with LearnDevNow. Subscribe today and save! http://pubads.g.doubleclick.net/gampad/clk?id=58040911&iu=/4140/ostg.clktrk _______________________________________________ nxlog-ce-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/nxlog-ce-users
