see
https://www.rsyslog.com/doc/v8-stable/rainerscript/variable_property_types.html
in the template, instead of msg you would use $.msg or $!msg (whichever you opt
to use)
and then you would do
set $!msg = replace($msg, 'etc', '');
or
set $.msg = replace($msg, 'etc', '');
let us know if you have more questions
David Lang
On Wed, 30 Dec 2020, Gi Actor via rsyslog wrote:
Date: Wed, 30 Dec 2020 23:51:20 +0300
From: Gi Actor via rsyslog <[email protected]>
To: rsyslog-users <[email protected]>
Cc: Gi Actor <[email protected]>
Subject: Re: [rsyslog] how to alter "msg" property with function replace()
This is interesting! Thank you very much indeed!
But how will I mention custom variables in templates?
Will you please share an example?
Mine now looks like below:
template (name="PolKit" type="list") {
property(name="timereported" dateFormat="year")
constant(value=" ")
property(name="timereported" dateFormat="month")
constant(value=" ")
property(name="timereported" dateFormat="day")
constant(value=" ")
...
}
But I'm perplexed how to finish it with the custom variables.
Basically the rsyslog configuration is like below:
if ($programname == 'polkitd' then {
reset $msg = replace($msg, 'etc', '');
action)type="omfile" file="/var/log/polkit.log" template="PolKit"
stop
}
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
