Use a lookup table -
https://www.rsyslog.com/doc/v8-stable/rainerscript/lookup_tables.html
here are some examples of using a lookup table to map priority numeric values
to log level string values, and log level values to their canonical
representation:
https://github.com/openshift/cluster-logging-operator/blob/master/files/rsyslog/normalize_level.json
https://github.com/openshift/cluster-logging-operator/blob/master/files/rsyslog/prio_to_level.json
This is how you declare and use them
https://github.com/openshift/cluster-logging-operator/blob/master/files/rsyslog/65-viaq-formatting.conf#L2
https://github.com/openshift/cluster-logging-operator/blob/master/files/rsyslog/65-viaq-formatting.conf#L191
https://github.com/openshift/cluster-logging-operator/blob/master/files/rsyslog/65-viaq-formatting.conf#L236
On 1/22/19 4:42 PM, Thomas Deutschmann via rsyslog wrote:
Hi,
On 2019-01-22 23:37, John Chivian wrote:
If I understand the need correctly, you could chop your $!timestamp (or
$msg) into pieces with the substring function, and then use the values
contained in the pieces. It's a way of "parsing" it yourself.
This could be a workaround, yes. How would I translate %b value, i.e.
the abbreviated month name into its numeric representation? 12 if
clauses or is there a better way?
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
