2011/12/13 <[email protected]>: > On Tue, 13 Dec 2011, Risto Vaarandi wrote: > >> ...to add another idea -- if you want to run a very fast normalization >> on logs with multi-line events, you could also take advantage of the >> LogPP (Log PreProcessor) utility at http://logpp.sourceforge.net. >> I wrote it some years ago for fast processing and flatfile -> syslog >> conversion. Although syslog-ng also allows for converting flatfile logs >> to syslog, they don't support couple of things that logpp can do for you >> -- multi-line to single-line conversion, and the ability to extract >> input file names from input events. > > does this tool handle a wildcard list of files? or just a single file? >
Wildcards are not supported, but it is possible to define several input files as one logical input source, and then apply the same processing rules for all files of the source. However, since logpp was written 5 years ago, it could well be that rsyslog has incorporated some quite similar features during this time. kind regards, risto ------------------------------------------------------------------------------ Systems Optimization Self Assessment Improve efficiency and utilization of IT resources. Drive out cost and improve service delivery. Take 5 minutes to use this Systems Optimization Self Assessment. http://www.accelacomm.com/jaw/sdnl/114/51450054/ _______________________________________________ Simple-evcorr-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
