On Thu, 18 Oct 2018, Rainer Gerhards wrote:
Hola Alberto,
El jue., 18 oct. 2018 a las 16:57, Alberto Alvarez Retuerto
(<alberto.alva...@acens.com>) escribió:
Sorry, I answer myself.
mmnormalize is processing "msg" only, and not "date", "tag" or
"hostname" fields.
actually you can specify what mmnormalize parses. "msg" is just the
default. See:
https://www.rsyslog.com/doc/v8-stable/configuration/modules/mmnormalize.html
For example, you could set useRawMsg="on" to parse "rawmsg".
what I do is I have the message converted into JSON as early as possible (with
$!msg holding whatever $msg normally has and additional metadata added), so I
create a new variable that contains the syslogtag and msg contents and then have
mmnormalize parse that (the timestamp and hostname are already in variables, so
no need to have the parser handle them)
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
