The dynamic url parsing is not yet supported, but probably something that is pretty useful in general and not too hard to do. Will check tomorrow.
Sent from phone, thus brief. -------- Ursprüngliche Nachricht -------- Von: Gary Foster <[email protected]> Datum: An: rsyslog-users <[email protected]> Betreff: Re: [rsyslog] rsyslog performance as receiver, heavily using regex in templates I *am* using v7 (HEAD actually). I haven't been able to craft anything yet to get mmnormalize to break it down that far but again, that could entirely be a PEBKAC error that I'm perfectly willing to cop to. I actually do use the json output format in v7 to with a template to form a CEE'ish sort of output (that is working quite well). My biggest difficulty seems to be butting my head up against mmnormalize right now and bending it to my will prior to that point. -- Gary F. On Jan 31, 2013, at 7:23 PM, David Lang <[email protected]> wrote: > On Thu, 31 Jan 2013, Gary Foster wrote: > >> I can easily break it down into the relevant fields with the rsyslog >> property replacer and mmnormalize… I can get the timestamp referring URL, >> etc all out of it. I can also build a basic CEE'ish sort of output using a >> template. However, what I really want is to break it down and normalize it >> into something that looks like this (written in json format, but I really >> want access to it as invididual properties): > > once you break it down with mmlognorm it should create individual properties > that you can then use throughout the rest of your rsyslog config (including > routing decisions) > > Also, you should look at the recent enhancements to JSON use in v7. I believe > that you should be albe to get the message parsed, manipulate the variables > (deleting some you don't want to have show up later), and then outputing in > the json format. > > David Lang_______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > LIKE THAT. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
