Hi there, I am having troubles getting rid of the space in the beginning of each field. (Yes, I know the spaces are according to RFC).
rsyslog is receiving logging from my docker container. For that I use additional tags to sort the logs according to their origin. However dumping that into a file, all these tags sit in front of the message. See a debug message on how this is structured in the end. As I only need the msg within the logfile, I use the following template: template(name="from-docker" type="string" string="%msg%\n") Simple and it basically does what I want. However as a space got added to the message, all the log files now have spaces in the beginning. This leads to trouble with all sorts of parsers. What can I add to the template, to just remove the leading space? (I have found ltrim, however I do not understand the documentation if that would help.) Kind Regards Christian Debug line with all properties: FROMHOST: 'diskstation', fromhost-ip: '127.0.0.1', HOSTNAME: 'diskstation', PRI: 30, syslogtag 'docker/nginx[828]:', programname: 'docker', APP-NAME: 'docker', PROCID: '828', MSGID: '-', TIMESTAMP: 'May 19 03:02:50', STRUCTURED-DATA: '-', msg: ' 192.168.2.117 - - [19/May/2020:03:02:50 +0200] "GET /storage/1.5/1/info/collections HTTP/2.0" 200 224 "-" "Firefox/76.0 (Linux x86_64) FxSync/1.78.0.20200429185419.desktop"' escaped msg: ' 192.168.2.117 - - [19/May/2020:03:02:50 +0200] "GET /storage/1.5/1/info/collections HTTP/2.0" 200 224 "-" "Firefox/76.0 (Linux x86_64) FxSync/1.78.0.20200429185419.desktop"' inputname: imuxsock rawmsg: '<30>May 19 03:02:50 docker/nginx[828]: 192.168.2.117 - - [19/May/2020:03:02:50 +0200] "GET /storage/1.5/1/info/collections HTTP/2.0" 200 224 "-" "Firefox/76.0 (Linux x86_64) FxSync/1.78.0.20200429185419.desktop"' $!: $.: $/: _______________________________________________ rsyslog mailing list https://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
