Hello Danno
Thank you for helping, I am able to replace the text i want with configs you
suggested.
But while using within a ruleset, it does not replace in the log file which
is being written by the application.
Could you please help me in sorting this out?
Below is how i am doing it, please correct me. ruleset will have other
parameters to send the logs to a target server, but right now i am just
trying to make it work locally and later i will mention the target and other
parameters.
$template test_template,"%PRI% %timestamp%
%programname%%msg:R,ERE,1,FIELD:(.*)text_to_replace/.*--end%
text_to_replace_wtih %msg:R,ERE,1,FIELD:.*text_to_replace(.*)--end%\n"
ruleset(name="sendToLocal") {
:msg, contains, "text_to_replace" stop
action(type="omfwd" Template="test_template")
}
input(type="imfile"
File="/path/to/my/logfile.log"
maxSubmitAtOnce="2048"
escapelf="on"
Tag="Tag_Name"
startmsg.regex="^[[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2}
[[:digit:]]{2}:[[:digit:]]{2}:[[:digit:]]{2},[[:digit:]]{3} "
Severity="info"
Ruleset="sendToLocal")
Thanks & Regards,
Pat
--
Sent from: http://rsyslog-users.1305293.n2.nabble.com/
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
