the question about how to fix up a message prompted a thought. This is a pretty
common problem, and it can be dealt with by creating a custom parsing module, or
a custom message modification module, but most of the time the fixups that are
needed are pretty simple.
so how about adding a reparse($!var) function that would take the contents of
$!var, put it in $rawmsg and run the parser stack against it?
This would allow people to do a lot of the common fixups with a few normal
rsyslog commands and then let the normal parsers populate all the variables.
With this approach, there would be a fixup section at the top of the config that
would clean up the messages, and then clean logic to output the messages.
Currently when you have this sort of thing, you end up with a bunch of sections
to handle individual broken types of messages with a bunch of custom templates,
so outputs end up getting specified many times.
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
