Hello everyone. First-time experimenting in rsyslog, so bear with me!
(Working on Centos 6, with rsyslog 8.13).
I'm investigating the Sample rule base examples, and having trouble with
both CSV examples.
This example works as advertised, but my logs will have blank fields,
and this rule doesn't handle blank columns.
# first field,second field,third field,fourth field
rule=csv:%r1:char-to:,%,%r2:char-to:,%,%r3:char-to:,%,%r4:rest%
This rule looks like it's intended to handle empty columns, but I can't
get it to work on the sample inputs provided, whether blank columns
included or not.
# CSV: field1,,field3
rule=better-csv:CSV: %f1:char-sep:,%,%f2:char-sep:,%,%f3:char-sep:,%
Here's what I'm working with...
# cat csvbetter.txt
field1,,field3
candy,cane,sticks
# cat /etc/rsyslog.d/csvbetter.rb
rule=better-csv:CSV: %f1:char-sep:,%,%f2:char-sep:,%,%f3:char-sep:,%
And here's the output:
# lognormalizer -r /etc/rsyslog.d/csvbetter.rb < csvbetter.txt
[cee@115 originalmsg="field1\,\,field3" unparsed-data="field1\,\,field3"]
[cee@115 originalmsg="candy\,cane\,sticks" unparsed-data="candy\,cane\,sticks"]
The rule is not parsing the lines and I can't figure out why not. I'm
copying straight out of the examples, so I guess I'm missing something.
TIA!
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
