Hi,
I figured my mistake. In the ForwardFormat i had msg. Replacing it with $!msg
did the trick 😊
Sample String.
"
Feb 25 09:05:01.029823 info MYHOST FaultHandler[14028]:
FaultHandler.cpp:46:Received Fault Msg from X process.
"
Warm Regards
Lak.
________________________________
From: rsyslog <rsyslog-boun...@lists.adiscon.com> on behalf of deoren
<rsyslog-users-lists.adiscon....@whyaskwhy.org>
Sent: Friday, February 23, 2018 3:51 PM
To: rsyslog@lists.adiscon.com
Subject: Re: [rsyslog] regex when used in conf files is giving hard-time
On 2/23/2018 3:19 AM, putcha narayana via rsyslog wrote:
> Hello Experts,
>
> Any help on my query about regular expression in rsyslog. The code below is
> not stripping off the <filename>.cpp from syslog.
>
> if ( $syslogseverity-text != 'debug')
> then
> {
> if re_match($msg, "[a-zA-Z0-9]+\\.cpp:[0-9]+")
> then
> {
> set $!ext =
> re_extract($msg,"([a-zA-Z0-9]+\\.cpp:[0-9]+)",0,1,"");
> set $!msg= replace($msg, $!ext, "xxxx");
> :omfile:$testlog;FileFormat
> }
> else
> set $!msg = $msg;
> }
>
> In Anticipation,
> Warm Regards
> Lak.
You may have already provided this (sorry if I overlooked it), but could
you provide a sample message that you'd like to modify?
If I get some time today I'll feed your test message into your example
config block provided to test the results and then offer feedback.
I'm new to this process as well, but will see if I am able to assist
even so.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
