On Mon, 28 Oct 2013, Rainer Gerhards wrote:
2. Liblognorm is unable to match last part of a string in some cases.
There is no field type which could fit anything till the end of string.
This quirk maybe arise from some ideology, but it makes impossible, for
example, to parse common CSV format, unless last field fits some of
predefined field types by accident. Currently, parsers are defined in
libee, and there is no interface to add one, which presents us with a
choice: extend libee or use own parsers. There can be other useful field
types, as well.
This came up on the list before. I thought there were some "rest of line"
type of syntax, but I had no time checking that. Looks like it isn't. I
think it would be a useful thing to have, even though this may lead to some
problems during the parser run.
as a quick hack, would it bwe possible to get a config option that would include
the newline at the end of a log message (or add one if it's missing) to give you
something to match against?
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
