The best way would be to create a custom parser using pmrfc3164 as template. You could probably also work via pmnormalize. All parsers here:
https://www.rsyslog.com/doc/master/configuration/modules/idx_parser.html Rainer 2018-07-20 11:29 GMT+02:00 Stephan Seitz <[email protected]>: > On Fr, Jul 20, 2018 at 11:17:16 +0200, Rainer Gerhards wrote: >> >> simple explanation: the colon cannot be part of a hostname (RFC >> restriction). So rsyslog know that "CES:" is not a hostname and the >> heuristic of the default parser so dos not assign one. In contrary. >> "CES" is a perfect hostname and so it is used as such. > > > Ah, thanks for the explanation. Is there a way to add the hostname in the > example with CES without the colon? > > > Shade and sweet water! > > Stephan > > -- > | Public Keys: http://fsing.rootsland.net/~stse/keys.html | > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > LIKE THAT. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
