On 21 Jan 2020, at 13:50, Dan Pritts wrote:
Just noticed that my template was mangled somehow.
It is still mangled, another set of * is missing. I am trying a
different
formatting below, which i hope will work for you.
$template test_template,"%timestamp% %programname%
%msg:R,ERE,1,FIELD:(.*)text_to_replace.*--end%
text_to_replace_with
%msg:R,ERE,1,FIELD:.*text_to_replace(.*)--end%"
Here is what it all means:
%msg:R,ERE,1,FIELD:(.*)text_to_replace.*--end%
This matches anything up to text_to_replace with the (.*) in the
parentheses. This
"sub match" in the parentheses is what gets printed. This line would
probably usually work as
originally sent but this way is better.
text_to_replace_with
This prints the replacement text.
%msg:R,ERE,1,FIELD:.*text_to_replace(.*)--end%"
This matches anything, then text_to_replace, then matches anything again
(.*). Again, the
"sub match" in the parentheses is what is printed.
good luck
danno
Dan Pritts
ICPSR Computing and Network Services
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
