On Fri, 18 May 2018, Maupertuis Philippe wrote:
However Jboss is sending logs with the TAG in square brackets and we end up
with an empty program name.
Here is an example of the log :
2018-05-18T11:00:26+02:00 xxxxxx [[email protected]]:
#033[0m#033[33m11:00:26,226 WARN ...
In such a case, we would like to use
[email protected]<mailto:[email protected]> or even jbossas7.
How can we test if the %programname% is empty ?
if $programname == '' then { stuff }
How can we create a new variable with the square brackets remove and possibly
the content split on the @ ?
set $.var = function();
see https://www.rsyslog.com/doc/v8-stable/rainerscript/functions.html for the
list of functions available. you should be able to use field/strlen/substring to
split out whatever you want
Then you can create a new template that includes $.var instead of programname
note that $! and $. work exactly the same way, $. was created so that there is a
place for variables that you don't want in the body of the message (allowing you
to use just $! to include all the variables you do want in the body of the
message)
Another approch would be that you can use mmnormalize against the rawmsg or a
string you create (say set $.test = $programname + " " + $msg; and then use
mmnormalize to parse $.test)
If you only have one oddball, a test for the empty programname followed by
manual manipulation may make the most sense, but if you are doing more than a
couple of them, mmnormalize will be faster and more straightforward to maintain.
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
