On Mon, Oct 28, 2013 at 5:12 PM, David Lang <[email protected]> wrote: > On Mon, 28 Oct 2013, Rainer Gerhards wrote: > >> >> 2. Liblognorm is unable to match last part of a string in some cases. >>> There is no field type which could fit anything till the end of string. >>> This quirk maybe arise from some ideology, but it makes impossible, for >>> example, to parse common CSV format, unless last field fits some of >>> predefined field types by accident. Currently, parsers are defined in >>> libee, and there is no interface to add one, which presents us with a >>> choice: extend libee or use own parsers. There can be other useful field >>> types, as well. >>> >>> >> This came up on the list before. I thought there were some "rest of line" >> type of syntax, but I had no time checking that. Looks like it isn't. I >> think it would be a useful thing to have, even though this may lead to >> some >> problems during the parser run. >> > > > as a quick hack, would it bwe possible to get a config option that would > include the newline at the end of a log message (or add one if it's > missing) to give you something to match against? > > doens't need a quick hack -- a new syntax is probably half an hour worth of effort, but.. I have to admit I hope Pavel has some need and time ;)
Rainer > David Lang > > ______________________________**_________________ > rsyslog mailing list > http://lists.adiscon.net/**mailman/listinfo/rsyslog<http://lists.adiscon.net/mailman/listinfo/rsyslog> > http://www.rsyslog.com/**professional-services/<http://www.rsyslog.com/professional-services/> > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
