Indeed there is http://www.liblognorm.com/files/manual/lognormalizer.html and
it is incredibly useful
On 12/11/18 4:18 PM, Joe Blow via rsyslog wrote:
Isn't there a lognormalize command you can use to test this stuff with? I
seem to remember being able to specify a rules file, and a log file, and it
will walk the logs and let you know which characters are wrong for your
rules.
Cheers,
JB
On Tue, Dec 11, 2018 at 3:31 PM David Lang <[email protected]> wrote:
On Tue, 11 Dec 2018, Lavanya Kanchanapalli via rsyslog wrote:
Hi,
I am trying to get mmnormalize work with examples given in liblognorm
documentation
<
https://github.com/rsyslog/liblognorm/blob/master/doc/configuration.rst#json
.
I tried a couple but could not get it to work. What is missing or how
can I
get mmnormalize to parse text as expected?
in most cases $msg starts with a space, so in your rules you need a space
after
the :
try that and then we can go from there
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
