Hi,
I'm struggling with MMNormalize for a while now and there is something I can't
do.
I have some logs coming form an internal application and they are formated that
way :
Feb 3 05:30:01 r410-01 FR_every5mn: 05 : 29912 Success release mutex 29912
Feb 3 05:30:01 r410-01 FR_every5mnAff: 05 : 30033 Param of job id #72448 is
local.BatchSRSending.sendLeadsToClient({"affiliate_code":"client_737588"})
Feb 3 05:30:01 r410-01 FR_batchImport: 05 : : CM_ImportAffiliate::importAll -
begin mailsAff
Feb 3 05:30:01 r410-01 FR_matchingAuto: 05 : Devis annules traites : 0 annules
Time in 00:00:00
Feb 3 05:30:01 r410-01 FR_envoi_sms: 05 : Control credits : 7348
Feb 3 05:30:01 r410-01 FR_every5mnAff: 05 : 30033
svcBatchSRSending::pub_sendLeadsToClient => client_737588 -> count iap 1
As you can see, the first part is quite easy to match until the "05" part.
Unfortunately, I can't match only part of a string with liblognorm so I must
match everything ... except that everything after the "05 :" part is not
matchable.
Ideally, this would be double quoted and thus, I could use the quoted-string
identifier but unfortunately, this is not the case.
Is there a way to do something like "char-to" which can take the whole string
until the end of the line ?
I tried something like this : %message:char-to:A% but it doesn't work :(
Any help gladly welcomed.
Regards.
Walid.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
