You should read the following announcement:
https://www.rsyslog.com/rsyslog-version-numbering-change/
For your parsing error, you're mixing different syntax.
template(name="isilon_tmpl" type="list") {
property(name="$!modmsg")
constant(value="\n")
}
Flo
On Wed, Mar 13, 2019 at 4:25 PM Secrist, Eric via rsyslog <
[email protected]> wrote:
> Thanks for the response John. I upgraded to version 8.1903.0 from version
> 8.24. I find it strange that 8.1903 is a more recent version than 8.24.
> I attempted to use your approach but ran into parsing config file errors.
>
> Here are the statements that produced the parsing errors:
>
> set $!modmsg = replace($msg,"|",",");
> template(name="isilon_tmpl" type="list") {
> string="$!msg\n"
> property(name="$!modmsg")
> }
>
> I also tried using the property statement as you described, outside of the
> template definition, but that also produced parsing errors.
>
> -----Original Message-----
> From: rsyslog <[email protected]> On Behalf Of John
> Chivian
> Sent: Tuesday, March 12, 2019 12:25 PM
> To: [email protected]
> Subject: Re: [rsyslog] [External] Re: String replacement
>
> This would be one of those issues where it's best to be at a recent
> version. From experience I can say that both JSON property handling and
> the reliability of the replace function are greatly improved since 8.24
> which is still the distro default for many. Here's what I do...
>
> set $!modmsg = replace($msg,"{","");
> property(name="$!modmsg")
>
> Regards,
>
>
> On 3/12/19 11:09 AM, Secrist, Eric via rsyslog wrote:
> > Thank you for the response and great information Flo.
> >
> > I tried the following and I am seeing blank lines in the output file. It
> looks like the $!msg variable is possibly empty?
> >
> > set $!msg = replace($msg, "|",",");
> > template(name="isilon_tmpl" type="string"
> > string="%!msg%\n"
> > )
> >
> >
> > From: Flo Rance <[email protected]>
> > Sent: Tuesday, March 12, 2019 2:20 AM
> > To: rsyslog-users <[email protected]>
> > Cc: Secrist, Eric <[email protected]>
> > Subject: [External] Re: [rsyslog] String replacement
> >
> >
> >
> > On Mon, Mar 11, 2019 at 11:01 PM Secrist, Eric via rsyslog <
> [email protected]<mailto:[email protected]>> wrote:
> > Hello,
> > For the following example message:
> >
> > 2019-03-11T14:13:10-07:00 xxxx-xxxx-xxxx-3 audit_protocol[9605]:
> > S-1-22-1-11111|11111|System|1|11.111.111.11|NFS|CLOSE|SUCCESS|FILE|0:0
> > |0:0|7528411024|/path/to/file
> >
> > Are the pipes field delimiters?
> >
> > Yes, the pipes are field delimiters.
> >
> > How can I replace the pipes (|s) with commas?
> >
> > I have tried the following template and many others, but haven't been
> able to get the pipe replacement to work yet.
> >
> > template(name="isilon_tmpl" type="list") {
> > replace("$msg", "|", ",")
> >
> > Two problems here. You try to replace in "$msg" string and not $msg
> property. Anyway, you can't directly modify $msg property, so you may try:
> >
> > set $!msg = replace($msg, "|", ",");
> >
> > and define your template to use $!msg.
> >
> > }
> >
> > ruleset(name="isilon_rset") {
> > if ($msg contains "/ifs/cda/userdata/ctshared") then {
> > action(type="omfile" FileCreateMode="0644"
> File="/var/log/remote/msg/eric-test" template="isilon_tmpl")
> > }
> > }
> >
> >
> > Thanks,
> > Eric Secrist
> > _______________________________________________
> > rsyslog mailing list
> > https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.adiscon.net_
> > mailman_listinfo_rsyslog&d=DwIGaQ&c=Sexio4usKrYWFsrnxgjbcQ&r=pqAh5TkcD
> > oUXyfMplnPebu6G3M_9z7cs9GV6oLVBaAA&m=h8SoL-AhMrYoNoDIsBXbdL5wPpDcPDmJB
> > ZlQpU9IHwc&s=BQVy0qzeHSmZI9Qi83MMJLwdqKJnw2thoHpFd4-1dak&e=<https://ur
> > ldefense.proofpoint.com/v2/url?u=http-3A__lists.adiscon.net_mailman_li
> > stinfo_rsyslog&d=DwMFaQ&c=Sexio4usKrYWFsrnxgjbcQ&r=pqAh5TkcDoUXyfMplnP
> > ebu6G3M_9z7cs9GV6oLVBaAA&m=8XhT8ajKinq5Dra9Hb3WyTeig-8bImP74XvX3Sh1Uz8
> > &s=9yIW5Zv2RpKp0qdNbo8FLDccxkb-mAEKQuz9Vao3mrw&e=>
> > https://urldefense.proofpoint.com/v2/url?u=http-3A__www.rsyslog.com_pr
> > ofessional-2Dservices_&d=DwIGaQ&c=Sexio4usKrYWFsrnxgjbcQ&r=pqAh5TkcDoU
> > XyfMplnPebu6G3M_9z7cs9GV6oLVBaAA&m=h8SoL-AhMrYoNoDIsBXbdL5wPpDcPDmJBZl
> > QpU9IHwc&s=TWxPkaMA6uW2o3aKK5CuPyOvaTXHC-AW0AadBmEuT0c&e=<https://urld
> > efense.proofpoint.com/v2/url?u=http-3A__www.rsyslog.com_professional-2
> > Dservices_&d=DwMFaQ&c=Sexio4usKrYWFsrnxgjbcQ&r=pqAh5TkcDoUXyfMplnPebu6
> > G3M_9z7cs9GV6oLVBaAA&m=8XhT8ajKinq5Dra9Hb3WyTeig-8bImP74XvX3Sh1Uz8&s=i
> > NjUhhXBm4JxgffTRp0GZbx0W-TX3YL46Zgpbm4Xnbo&e=>
> > What's up with rsyslog? Follow
> > https://urldefense.proofpoint.com/v2/url?u=https-3A__twitter.com_rgerh
> > ards&d=DwIGaQ&c=Sexio4usKrYWFsrnxgjbcQ&r=pqAh5TkcDoUXyfMplnPebu6G3M_9z
> > 7cs9GV6oLVBaAA&m=h8SoL-AhMrYoNoDIsBXbdL5wPpDcPDmJBZlQpU9IHwc&s=-jYFa4Y
> > PhJAkVumTBDXMArLcuFpPtHfDnfqBVQEjts8&e=<https://urldefense.proofpoint.
> > com/v2/url?u=https-3A__twitter.com_rgerhards&d=DwMFaQ&c=Sexio4usKrYWFs
> > rnxgjbcQ&r=pqAh5TkcDoUXyfMplnPebu6G3M_9z7cs9GV6oLVBaAA&m=8XhT8ajKinq5D
> > ra9Hb3WyTeig-8bImP74XvX3Sh1Uz8&s=syIr7Hk0NNCKG1X2NPXWvdxxOTa1Vv1cYb7AF
> > JDhowY&e=> NOTE WELL: This is a PUBLIC mailing list, posts are
> > ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and
> DO NOT POST if you DON'T LIKE THAT.
> > _______________________________________________
> > rsyslog mailing list
> > https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.adiscon.net_
> > mailman_listinfo_rsyslog&d=DwIGaQ&c=Sexio4usKrYWFsrnxgjbcQ&r=pqAh5TkcD
> > oUXyfMplnPebu6G3M_9z7cs9GV6oLVBaAA&m=h8SoL-AhMrYoNoDIsBXbdL5wPpDcPDmJB
> > ZlQpU9IHwc&s=BQVy0qzeHSmZI9Qi83MMJLwdqKJnw2thoHpFd4-1dak&e=
> > https://urldefense.proofpoint.com/v2/url?u=http-3A__www.rsyslog.com_pr
> > ofessional-2Dservices_&d=DwIGaQ&c=Sexio4usKrYWFsrnxgjbcQ&r=pqAh5TkcDoU
> > XyfMplnPebu6G3M_9z7cs9GV6oLVBaAA&m=h8SoL-AhMrYoNoDIsBXbdL5wPpDcPDmJBZl
> > QpU9IHwc&s=TWxPkaMA6uW2o3aKK5CuPyOvaTXHC-AW0AadBmEuT0c&e=
> > What's up with rsyslog? Follow
> > https://urldefense.proofpoint.com/v2/url?u=https-3A__twitter.com_rgerh
> > ards&d=DwIGaQ&c=Sexio4usKrYWFsrnxgjbcQ&r=pqAh5TkcDoUXyfMplnPebu6G3M_9z
> > 7cs9GV6oLVBaAA&m=h8SoL-AhMrYoNoDIsBXbdL5wPpDcPDmJBZlQpU9IHwc&s=-jYFa4Y
> > PhJAkVumTBDXMArLcuFpPtHfDnfqBVQEjts8&e=
> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
> DON'T LIKE THAT.
>
>
> _______________________________________________
> rsyslog mailing list
>
> https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.adiscon.net_mailman_listinfo_rsyslog&d=DwIGaQ&c=Sexio4usKrYWFsrnxgjbcQ&r=pqAh5TkcDoUXyfMplnPebu6G3M_9z7cs9GV6oLVBaAA&m=h8SoL-AhMrYoNoDIsBXbdL5wPpDcPDmJBZlQpU9IHwc&s=BQVy0qzeHSmZI9Qi83MMJLwdqKJnw2thoHpFd4-1dak&e=
>
> https://urldefense.proofpoint.com/v2/url?u=http-3A__www.rsyslog.com_professional-2Dservices_&d=DwIGaQ&c=Sexio4usKrYWFsrnxgjbcQ&r=pqAh5TkcDoUXyfMplnPebu6G3M_9z7cs9GV6oLVBaAA&m=h8SoL-AhMrYoNoDIsBXbdL5wPpDcPDmJBZlQpU9IHwc&s=TWxPkaMA6uW2o3aKK5CuPyOvaTXHC-AW0AadBmEuT0c&e=
> What's up with rsyslog? Follow
> https://urldefense.proofpoint.com/v2/url?u=https-3A__twitter.com_rgerhards&d=DwIGaQ&c=Sexio4usKrYWFsrnxgjbcQ&r=pqAh5TkcDoUXyfMplnPebu6G3M_9z7cs9GV6oLVBaAA&m=h8SoL-AhMrYoNoDIsBXbdL5wPpDcPDmJBZlQpU9IHwc&s=-jYFa4YPhJAkVumTBDXMArLcuFpPtHfDnfqBVQEjts8&e=
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
> DON'T LIKE THAT.
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
> DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
