Delete / Replace space

This is the place for you, if you got rsyslog up and running but wonder how to make it do what you want.

Moderator: rgerhards

Google Ads


Delete / Replace space

Postby rsysloguser98 » Tue Dec 19, 2017 11:15 am

Hello all,

I'm running a rsyslog server 7.4.

I would like to modify the logs received by the server and I'm not sure if that is possible.

When received the format of the logs is not what I want, there is a space that I would like to get rid off. Is such a thing possible with Rsyslog ?

The logs is :
xyz:abc: 123:[....]
And i would like it :
xyz:abc:123:[....]
rsysloguser98
New
 
Posts: 2
Joined: Wed Apr 05, 2017 3:35 pm

Urgent Question?

  • Pulling out your Hair?
  • Wasting Time and Money?
  • Deadline Approaching?

Re: Delete / Replace space

Postby deoren » Wed Dec 20, 2017 7:10 am

I'm not as familiar with the 7.x series, but this appears to be where you'll want to start reading:

http://www.rsyslog.com/doc/v7-stable/co ... lates.html

xyz:abc: 123:[....]
And i would like it :
xyz:abc:123:[....]


I believe what you're listing pseudo-code for is:

Code: Select all
TIMESTAMP:HOSTNAME: SYSLOGTAG


with your intended result being (lack of space between hostname and syslogtag):

Code: Select all
TIMESTAMP:HOSTNAME:SYSLOGTAG


Assuming you're using the Traditional File Format template, this is what is currently defined:

Code: Select all
$template TraditionalFileFormat,"%TIMESTAMP% %HOSTNAME% %syslogtag%%msg:::sp-if-no-1st-sp%%msg:::drop-last-lf%\n"


You could instead create a template like this:

Code: Select all
$template ModifiedTraditionalFileFormat,"%TIMESTAMP%%HOSTNAME%%syslogtag%%msg:::sp-if-no-1st-sp%%msg:::drop-last-lf%\n"


and if you're looking for literal colons I think you could use this:

Code: Select all
$template ModifiedTraditionalFileFormat,"%TIMESTAMP%:%HOSTNAME%:%syslogtag%:%msg:::sp-if-no-1st-sp%%msg:::drop-last-lf%\n"


If you want ALL logs to use the same template you could redefine the default template, or just reference your custom template from whatever statements you're using to write to files. As the page I linked to explains, you also have the newer "advanced" (formerly known as RainerScript) format for defining templates. It's a little more verbose, but I like it because I feel I can more easily reference message properties and break apart the output.


Code: Select all
template(name="FileFormat" type="list") {
    property(name="timestamp" dateFormat="rfc3339")
    constant(value=" ")
    property(name="hostname")
    constant(value=" ")
    property(name="syslogtag")
    property(name="msg" spifno1stsp="on" )
    property(name="msg" droplastlf="on" )
    constant(value="\n")
    }


That stock/default template is taken verbatim from the page I linked to. Notice the "constant" statements used in that template definition. If you replace the space between the double quotes with a colon I believe it will give you roughly what you're after:

Code: Select all
template(name="ModifiedTraditionalFileFormat" type="list") {
    property(name="timestamp")
    constant(value=":")
    property(name="hostname")
    constant(value=":")
    property(name="syslogtag")
    property(name="msg" spifno1stsp="on" )
    property(name="msg" droplastlf="on" )
    constant(value="\n")
    }


Again, how you use the template will depend on how your configuration currently looks: what format are you using? Can you post what statements you're using to write to files now?

Here are some examples of "binding a template":

http://www.rsyslog.com/how-to-bind-a-template/
deoren
New
 
Posts: 3
Joined: Wed Dec 13, 2017 6:49 am

Re: Delete / Replace space

Postby rsysloguser98 » Wed Dec 20, 2017 9:44 am

Thank you for this very precise and complete answer. I will try these options.

Here is the statement I'm using to write :

Code: Select all
action(template="RSYSLOG_TraditionalFileFormat" type="omfile" File="/opt/pipe/pipe3")
rsysloguser98
New
 
Posts: 2
Joined: Wed Apr 05, 2017 3:35 pm

Google Ads



Return to Configuration

Who is online

Users browsing this forum: No registered users and 1 guest

cron