David, Thank you for replying.
I tried the "F" operation ... but it didn't work properly. I am using "rsyslogd 6.3.0". I've specified the position 3 (%msg:F:3%), but it always give me the first field and the second one. This feature is available from which version? If I need more than one field (Positions 3, 5 and 6), I just need to do something like %msg:F:3:5:6%? Regards, Flavio > Date: Tue, 30 Oct 2012 06:02:08 -0700 > From: [email protected] > To: [email protected] > Subject: Re: [rsyslog] Parsing msg > > On Tue, 30 Oct 2012, Flavio Oliveira wrote: > > > > > Hi, > > > > I know that Rsyslog supports Regex however I think it only supports > > compare-operations. > > > > I would like to parse the received MSG and only send specific fields to > > another Rsyslog Server. Is it possible? > > > > Ex.: request 10000 20000 30000 url agent 50000 > > > > In the message (tab separated values) above, I would like to send only the > > values 10000 20000 and 50000. > > > > is there anyway to do it with Rsyslog? > > Yes, you can create a template that includes only some fields of the > message. > > look at http://www.rsyslog.com/doc/rsyslog_conf_templates.html and > http://www.rsyslog.com/doc/property_replacer.html > > especially the section on fields on the second page (search the page for > "F") > > David Lang > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > LIKE THAT. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
