> -----Original Message----- > From: [email protected] [mailto:rsyslog- > [email protected]] On Behalf Of [email protected] > Sent: Wednesday, June 03, 2009 4:04 AM > To: rsyslog-users > Subject: Re: [rsyslog] Property replacer manipulation question > > On Tue, 2 Jun 2009, Sayan Chowdhury wrote: > > > Hello David, > > Thanks for replying. > > > > I think I should have made my template clearer as well ... > > Actually these mac/ip addresses appear in the message portion. with > > different kind of logging message that the system generates > > so my rule should work for for a message like this as well > > > > > > May 25 08:41:13. 00145e178cc8[12703]: 4|172|CORE| IP 10.0.0.87 assigned to > > device DEVICE_0 > > should become something like > > > > > > May 25 08:41:13. [HIDDEN MAC][12703]: 4|172|CORE| IP [HIDDEN IP] assigned to > > device DEVICE_0 > > > > > > also, the other requirement I have is to change the facility Id in the > > outgoing syslog message. > > there are few enough facility Ids that you can put them into the template > > > That's when I thought about a search and replace functionality with the > > property replacer ... > > Not sure whether it is possible though, so far I have been able to write > > property replacers which can drop line feed, or replace / with an _ but not > > something like this. > > I haven't seen any ability to do arbatrary search-and-replace in rsyslog.
This is not available, but sounds like a good idea. I suggest to add a feature enhancement ticket to the bug tracker. Be warned, though, that I currently simply have no time to implement it. But it may happen as a by-activity when I change things in the property replacer, so it would be good not to forget about it. Rainer _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
