On 23/04/2019 19:24, David Lang wrote:
most people use mmnormalize to parse the msg part later in the config,
the pmnormalize is normally used for situations where the log does not
have the headers as defined by either rfc (3164 or 5424)
Ah... that is the clue I needed. pmnormalize != mmnormalize. It looks
like I'd just call it as an action().
Related question: it looks like one ruleset can call another, via call():
https://www.rsyslog.com/doc/v8-stable/rainerscript/rainerscript_call.html
However, the documentation says a ruleset can have both parsers and
actions, and if not specified the parsers default to the [5424, 3164] set.
So if an input is bound to ruleset A, and ruleset A calls ruleset B,
what happens when A and B specify the same parsers? What happens when
they specify different parsers?
Do only the top-level parsers (those in ruleset A) get invoked? Or do
the parsers from A and B both get invoked? Or something else?
Thanks,
Brian.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
