MonitorWare Knowledge Base

Along with the standard syslog message contents, I have some messages which are formatted as

VAR1=VAL1 VAR2=VAL2 VAR3=VAL3

I would like these to be inserted into my database table in the columns VAR1, VAR2 and VAR3.

Is there a way to do this ? The standard templates allow me some flexibility but not the ability to extract field contents and insert into new columns.

• Custom written rsyslog.conf?
• Maintenance Contract?
• Installation support?

See http://www.rsyslog.com/doc-property_replacer.html, especially the part about regular expressions. This should do the trick.

Rainer

I've got the regular expressions to work. However, what I would like is

If the string does not appear in the syslog message, a NULL value is inserted into the database. If the string does appear, the value is inserted.

What I currently get is that if the value does not appear, I get '***NO MATCH***' inserted.

Is there a way to override the default behaviour and insert NULL ? The code seemed pretty hard-coded.


For reference, my template line is

$template tapelog,"insert into tapelog(host, facility, priority, tag, datetime, program, msg,vid) values ('%HOSTNAME%', %syslogfacility%, %syslogpriority%, '%syslogtag%', '%timegenerated:::date-rfc3339%', '%programname%', '%msg%','%msg:R:VID=\([^ ]*\)--end%')", stdSQL

Do you really need a NULL? I am asking because that would require a change to the SQL statement itself, not just the field contents. This is currently not possible (but I am working on a new system where it will be). However, changing the "***NO MATCH***" to be an empty string "" would be easy. Would that do the trick (but its not a NULL...)?

Rainer