what format is %b? (apache logfile uses %b for bytes returned.
it may be possible to parse the data with mmnormalize.
you can also use a custom script with mmexternal.
David Lang
On Mon, 3 Aug 2015, chenlin rao wrote:
It's difficult to transform %b into rfc339 format. So many logs use %b ,
error log, slow log etc.
2015-08-03 11:39 GMT+08:00 David Lang <[email protected]>:
On Mon, 3 Aug 2015, chenlin rao wrote:
I want a function like logstash-filter-date. For example:
```
$!datetime = strptime("%d/%m/%Y:%H:%M:%s", $!json!datetime);
template(name="ls" type="list") {property(name="!datetime"
dateFormat="rfc3339")...}
```
But seems like rainerscript can only return number, string, array or json?
look at the property replacer
http://www.rsyslog.com/doc/v8-stable/configuration/property_replacer.html
It's not as simple to create arbitrary formats, but it covers a bunch of
the formats you normally need.
David ang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
