Once a parse successfully parsed, no other one is invoked. Rainer
Sent from phone, thus brief. Brian Candler via rsyslog <[email protected]> schrieb am Di., 23. Apr. 2019, 22:03: > On 23/04/2019 20:50, David Lang wrote: > > where in the documentation does it say a ruleset can have a parser? > > > https://www.rsyslog.com/doc/v8-stable/configuration/parser.html > > where it gives this example: > > ruleset(name="myRuleset" > parser=["rsyslog.lastline","rsyslog.aixforwardedfrom","rsyslog.rfc5424","rsyslog.rfc3164"]) > { > ... do something here ... > } > > That made me think that the list of parsers is an attribute of the ruleset. > > Also https://www.rsyslog.com/doc/v8-stable/concepts/multi_ruleset.html > where it says: > > "Custom message parsers, used to handle different (and potentially > otherwise-invalid) message formats, can be bound to rulesets." > > Also > > https://www.rsyslog.com/doc/v8-stable/concepts/messageparser.html#where-are-parser-chains-used > where it says: > > "The question is now how many parser chains can be active and how it is > decided which parser chain is used on which message. This is controlled > viarsyslog’s rulesets > <https://www.rsyslog.com/doc/v8-stable/concepts/multi_ruleset.html>. In > short, multiple rulesets can be defined and there always exist at least > one ruleset. A parser chain is bound to a specific ruleset." > > > But it's hard to find further examples of the ruleset(... parser=...) > syntax. > > > > parsing of the message happens in the input module, before any ruleset > > (including the default ruleset) > > Then how is the input module configured with the list of parsers to use? > > Regards, > > Brian. > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
