well, scratch this out. I don't know how many times I read over the
rule, and didn't realize that the rule was matching the "CSV: " literal
before parsing the csv columns. :-(
Now it's working. :-|
On 10/08/2015 04:18 PM, Dave Burkholder wrote:
Hello everyone. First-time experimenting in rsyslog, so bear with me!
(Working on Centos 6, with rsyslog 8.13).
I'm investigating the Sample rule base examples, and having trouble
with both CSV examples.
This example works as advertised, but my logs will have blank fields,
and this rule doesn't handle blank columns.
# first field,second field,third field,fourth field
rule=csv:%r1:char-to:,%,%r2:char-to:,%,%r3:char-to:,%,%r4:rest%
This rule looks like it's intended to handle empty columns, but I
can't get it to work on the sample inputs provided, whether blank
columns included or not.
# CSV: field1,,field3
rule=better-csv:CSV: %f1:char-sep:,%,%f2:char-sep:,%,%f3:char-sep:,%
Here's what I'm working with...
# cat csvbetter.txt
field1,,field3
candy,cane,sticks
# cat /etc/rsyslog.d/csvbetter.rb
rule=better-csv:CSV: %f1:char-sep:,%,%f2:char-sep:,%,%f3:char-sep:,%
And here's the output:
# lognormalizer -r /etc/rsyslog.d/csvbetter.rb < csvbetter.txt
[cee@115 originalmsg="field1\,\,field3" unparsed-data="field1\,\,field3"]
[cee@115 originalmsg="candy\,cane\,sticks"
unparsed-data="candy\,cane\,sticks"]
The rule is not parsing the lines and I can't figure out why not. I'm
copying straight out of the examples, so I guess I'm missing something.
TIA!
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST
if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
