Re: [rsyslog] Question on multiline log messages

2018-09-11 Thread Rich Megginson via rsyslog
https://github.com/rsyslog/rsyslog/pull/3014 On 09/06/2018 05:07 PM, Rich Megginson via rsyslog wrote: On 09/06/2018 12:49 PM, Rich Megginson wrote: On 09/06/2018 11:30 AM, David Lang wrote: On Thu, 6 Sep 2018, Rich Megginson wrote: On 09/06/2018 12:00 PM, Noriko Hosoi via rsyslog wrote:

Re: [rsyslog] Question on multiline log messages

2018-09-06 Thread Rich Megginson via rsyslog
On 09/06/2018 12:49 PM, Rich Megginson wrote: On 09/06/2018 11:30 AM, David Lang wrote: On Thu, 6 Sep 2018, Rich Megginson wrote: On 09/06/2018 12:00 PM, Noriko Hosoi via rsyslog wrote: Thank you for your response, David. On 09/06/2018 06:18 AM, David Lang wrote: There is an option for

Re: [rsyslog] Question on multiline log messages

2018-09-06 Thread Rich Megginson via rsyslog
On 09/06/2018 03:45 PM, David Lang wrote: On Thu, 6 Sep 2018, Rich Megginson wrote: Just to clarify - rsyslog does not currently support "multiline" docker json-file nor crio logs because there is no endmsg.regex - we would need to add support for that first in order to use mmnormalize repeat

Re: [rsyslog] Question on multiline log messages

2018-09-06 Thread David Lang
On Thu, 6 Sep 2018, Rich Megginson wrote: Just to clarify - rsyslog does not currently support "multiline" docker json-file nor crio logs because there is no endmsg.regex - we would need to add support for that first in order to use mmnormalize repeat and foreach as you have described above.

Re: [rsyslog] Question on multiline log messages

2018-09-06 Thread Rich Megginson via rsyslog
On 09/06/2018 11:57 AM, David Lang wrote: On Thu, 6 Sep 2018, Rich Megginson wrote: That is, if multiline specifically means records like this: first line of recordA    recordA second line    recordA third line first line of recordB Perhaps Noriko and I mean something slightly different

Re: [rsyslog] Question on multiline log messages

2018-09-06 Thread David Lang
On Thu, 6 Sep 2018, Rich Megginson wrote: That is, if multiline specifically means records like this: first line of recordA    recordA second line    recordA third line first line of recordB Perhaps Noriko and I mean something slightly different by "multiline" - a single message spread

Re: [rsyslog] Question on multiline log messages

2018-09-06 Thread Rich Megginson via rsyslog
On 09/06/2018 11:30 AM, David Lang wrote: On Thu, 6 Sep 2018, Rich Megginson wrote: On 09/06/2018 12:00 PM, Noriko Hosoi via rsyslog wrote: Thank you for your response, David. On 09/06/2018 06:18 AM, David Lang wrote: There is an option for imfile to split a file into multiline messages

Re: [rsyslog] Question on multiline log messages

2018-09-06 Thread David Lang
On Thu, 6 Sep 2018, Rich Megginson wrote: On 09/06/2018 12:00 PM, Noriko Hosoi via rsyslog wrote: Thank you for your response, David. On 09/06/2018 06:18 AM, David Lang wrote: There is an option for imfile to split a file into multiline messages based on a regex, that is probably the right

Re: [rsyslog] Question on multiline log messages

2018-09-06 Thread Rich Megginson via rsyslog
On 09/06/2018 12:00 PM, Noriko Hosoi via rsyslog wrote: Thank you for your response, David. On 09/06/2018 06:18 AM, David Lang wrote: There is an option for imfile to split a file into multiline messages based on a regex, that is probably the right starting point. Yes, we also expected

Re: [rsyslog] Question on multiline log messages

2018-09-06 Thread Noriko Hosoi via rsyslog
Thank you for your response, David. On 09/06/2018 06:18 AM, David Lang wrote: There is an option for imfile to split a file into multiline messages based on a regex, that is probably the right starting point. Yes, we also expected startmsg.regex could be used for our purpose.

Re: [rsyslog] Question on multiline log messages

2018-09-06 Thread David Lang
There is an option for imfile to split a file into multiline messages based on a regex, that is probably the right starting point. Note that a LOT of log processing tools assume a log message is a single line, so you probably want to have newlines escaped in the message before sending it to