this doesn't solve the problem because it can only return a string.
I want to tokenize and then use something more complex (json, name-value-list, iptables, cef, etc)
David Lang On Fri, 29 May 2015, singh.janmejay wrote:
Should we have an optional argument in word: except. Eg. %foo:word:&%%bar:word% Given baz&quux will give us: {"foo" : "baz", "bar": "quux"} If we take multiple chars (allow escaped unicode sequences), we can say the default value of this field is 'space' and 'tab'. On Fri, May 29, 2015 at 1:38 AM, David Lang <[email protected]> wrote:I think that the config rule=:%foo:tokenized:&:word% against the string "1&2&3" should return { "foo": [ "1", "2", "3" ] } but instead it returns { "foo": [ "1&2&3" ] } because 'word' is applied before the split of tokenized. If I change 'word' to 'number' it performs as expected (returning three values) this can be worked around by doing rule=:%foo:tokenized:&:char-sep:&% but this is ugly, and it prevents doing anything smarter (such as a descent or recursive that would be able to split a name-value pair) https://github.com/rsyslog/liblognorm/issues/64 filed for this. David Lang _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
_______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
