If you want to trim the first char from msg, this should work:
template(name="from-docker" type="string" string="%msg:2:$:%\n")
Many people have run into this problem in the past. A quick google turns
up some fun stories of how folks found it.
https://runnable.com/blog/the-mysterious-case-of-the-leading-space
Hope this helps.
Cheers,
JB
On Tue, May 19, 2020 at 1:17 PM Christian via rsyslog <
rsyslog@lists.adiscon.com> wrote:
> Hi there,
>
> I am having troubles getting rid of the space in the beginning of each
> field. (Yes, I know the spaces are according to RFC).
>
> rsyslog is receiving logging from my docker container. For that I use
> additional tags to sort the logs according to their origin. However
> dumping that into a file, all these tags sit in front of the message.
> See a debug message on how this is structured in the end.
>
> As I only need the msg within the logfile, I use the following
> template:
>
> template(name="from-docker" type="string" string="%msg%\n")
>
> Simple and it basically does what I want. However as a space got added
> to the message, all the log files now have spaces in the beginning.
> This leads to trouble with all sorts of parsers.
>
> What can I add to the template, to just remove the leading space?
> (I have found ltrim, however I do not understand the documentation if
> that would help.)
>
> Kind Regards
> Christian
>
>
> Debug line with all properties:
> FROMHOST: 'diskstation', fromhost-ip: '127.0.0.1', HOSTNAME:
> 'diskstation', PRI: 30,
> syslogtag 'docker/nginx[828]:', programname: 'docker', APP-NAME:
> 'docker', PROCID: '828', MSGID: '-',
> TIMESTAMP: 'May 19 03:02:50', STRUCTURED-DATA: '-',
> msg: ' 192.168.2.117 - - [19/May/2020:03:02:50 +0200] "GET
> /storage/1.5/1/info/collections HTTP/2.0" 200 224 "-" "Firefox/76.0
> (Linux x86_64) FxSync/1.78.0.20200429185419.desktop"'
> escaped msg: ' 192.168.2.117 - - [19/May/2020:03:02:50 +0200] "GET
> /storage/1.5/1/info/collections HTTP/2.0" 200 224 "-" "Firefox/76.0
> (Linux x86_64) FxSync/1.78.0.20200429185419.desktop"'
> inputname: imuxsock rawmsg: '<30>May 19 03:02:50 docker/nginx[828]:
> 192.168.2.117 - - [19/May/2020:03:02:50 +0200] "GET
> /storage/1.5/1/info/collections HTTP/2.0" 200 224 "-" "Firefox/76.0
> (Linux x86_64) FxSync/1.78.0.20200429185419.desktop"'
> $!:
> $.:
> $/:
>
>
>
> ___
> rsyslog mailing list
> https://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
> DON'T LIKE THAT.
>
___
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
