> Yes, but how do I control which parts of a message will be treated as > which fields? You see, I would like to have a %request_id% which would > be the last field before the actual message text for example.
You need to look into the rsyslog property replacer, which can be used to extract parts of a fieled (e.g. msg or rawmsg). Given what you said, you probably need to work with regular expressions, but may get along with a cheaper thing, like delimited fields. To help crafting regexes, there is an online check tool available at: http://www.rsyslog.com/regex/ Rainer _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
