If you want to trim the first char from msg, this should work: template(name="from-docker" type="string" string="%msg:2:$:%\n")
Many people have run into this problem in the past. A quick google turns up some fun stories of how folks found it. https://runnable.com/blog/the-mysterious-case-of-the-leading-space Hope this helps. Cheers, JB On Tue, May 19, 2020 at 1:17 PM Christian via rsyslog < rsyslog@lists.adiscon.com> wrote: > Hi there, > > I am having troubles getting rid of the space in the beginning of each > field. (Yes, I know the spaces are according to RFC). > > rsyslog is receiving logging from my docker container. For that I use > additional tags to sort the logs according to their origin. However > dumping that into a file, all these tags sit in front of the message. > See a debug message on how this is structured in the end. > > As I only need the msg within the logfile, I use the following > template: > > template(name="from-docker" type="string" string="%msg%\n") > > Simple and it basically does what I want. However as a space got added > to the message, all the log files now have spaces in the beginning. > This leads to trouble with all sorts of parsers. > > What can I add to the template, to just remove the leading space? > (I have found ltrim, however I do not understand the documentation if > that would help.) > > Kind Regards > Christian > > > Debug line with all properties: > FROMHOST: 'diskstation', fromhost-ip: '127.0.0.1', HOSTNAME: > 'diskstation', PRI: 30, > syslogtag 'docker/nginx[828]:', programname: 'docker', APP-NAME: > 'docker', PROCID: '828', MSGID: '-', > TIMESTAMP: 'May 19 03:02:50', STRUCTURED-DATA: '-', > msg: ' 192.168.2.117 - - [19/May/2020:03:02:50 +0200] "GET > /storage/1.5/1/info/collections HTTP/2.0" 200 224 "-" "Firefox/76.0 > (Linux x86_64) FxSync/1.78.0.20200429185419.desktop"' > escaped msg: ' 192.168.2.117 - - [19/May/2020:03:02:50 +0200] "GET > /storage/1.5/1/info/collections HTTP/2.0" 200 224 "-" "Firefox/76.0 > (Linux x86_64) FxSync/1.78.0.20200429185419.desktop"' > inputname: imuxsock rawmsg: '<30>May 19 03:02:50 docker/nginx[828]: > 192.168.2.117 - - [19/May/2020:03:02:50 +0200] "GET > /storage/1.5/1/info/collections HTTP/2.0" 200 224 "-" "Firefox/76.0 > (Linux x86_64) FxSync/1.78.0.20200429185419.desktop"' > $!: > $.: > $/: > > > > _______________________________________________ > rsyslog mailing list > https://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list https://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
