Hi ALL,
I want to ask, by using mmnormalize , if i have a log of type this say
1) This is a Test ( 1 space between 'a' & Test)
2) This is a Test ( 2 spaces between 'a' & Test)
3) This is a Test ( 3 spaces between 'a' & Test)
4) This is a Test ( 4 spaces between 'a' & Test)
and i write a rule like this
rule=: %word1:word% %word2:word% %word3:word% %word4:word%
this is capturing every word but with one space only, now how i can handle
case 2,3,4 in which there are more than one space between 'a' & Test.
more specifically how i can handle multiple spaces in rule. OR do i have to
write separate rules which handle these 4 cases.
one more thing , what if i don't want to capture any filed among the above
mentioned string but at advance i am not aware what will appear in that
string , means i can't hardcode it in rule. for example in log
This is a Test.
I don't want to capture 'a' , i can write rule
rule=: %word1:word% %word2:word% a %word4:word%
but if i'm not sure if 'a' will appear there or not , i mean it could be
possible that log appears like "This is not Test" ,, now in this case i
hardcoded 'a' but in log it appears 'not'.
i am using rsyslog 7.6.3 on centOS, and 8.4 on CentOS.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
