Skip to main content
forgot to correct field() arg order
Source Link
meuh
  • 54.7k
  • 2
  • 70
  • 138

Actions are executed at the place they occur, so the first action should be after the set commands. The second action does nothing useful and should be removed; it does not "unset" a previous action.

The function replace() does not understand regexps, only plain substrings. There is no need for one as the property rawmsg-after-pri holds the message starting after the <190> priority.

$$ should not be used except for system properties which begin with $, e.g. $$hour.

The function field() expects the 2nd argument to be the delimiter character, and the 3rd argument to be the count, not vice versa.

A dynamic filename is specified with the option dynaFile= followed by the name of a template in double-quotes, eg:

template(name="logfile" type="string" string="/.../%$.key%")
set $.key = field($rawmsg-after-pri, 1";", ";"1);
set $.msg = field($rawmsg, 2";", ";"2);
action(type="omfile" dynaFile="logfile" template="debug_format")

Actions are executed at the place they occur, so the first action should be after the set commands. The second action does nothing useful and should be removed; it does not "unset" a previous action.

The function replace() does not understand regexps, only plain substrings. There is no need for one as the property rawmsg-after-pri holds the message starting after the <190> priority.

$$ should not be used except for system properties which begin with $, e.g. $$hour.

The function field() expects the 2nd argument to be the delimiter character, and the 3rd argument to be the count, not vice versa.

A dynamic filename is specified with the option dynaFile= followed by the name of a template in double-quotes, eg:

template(name="logfile" type="string" string="/.../%$.key%")
set $.key = field($rawmsg-after-pri, 1, ";");
set $.msg = field($rawmsg, 2, ";");
action(type="omfile" dynaFile="logfile" template="debug_format")

Actions are executed at the place they occur, so the first action should be after the set commands. The second action does nothing useful and should be removed; it does not "unset" a previous action.

The function replace() does not understand regexps, only plain substrings. There is no need for one as the property rawmsg-after-pri holds the message starting after the <190> priority.

$$ should not be used except for system properties which begin with $, e.g. $$hour.

The function field() expects the 2nd argument to be the delimiter character, and the 3rd argument to be the count, not vice versa.

A dynamic filename is specified with the option dynaFile= followed by the name of a template in double-quotes, eg:

template(name="logfile" type="string" string="/.../%$.key%")
set $.key = field($rawmsg-after-pri, ";", 1);
set $.msg = field($rawmsg, ";", 2);
action(type="omfile" dynaFile="logfile" template="debug_format")
Source Link
meuh
  • 54.7k
  • 2
  • 70
  • 138

Actions are executed at the place they occur, so the first action should be after the set commands. The second action does nothing useful and should be removed; it does not "unset" a previous action.

The function replace() does not understand regexps, only plain substrings. There is no need for one as the property rawmsg-after-pri holds the message starting after the <190> priority.

$$ should not be used except for system properties which begin with $, e.g. $$hour.

The function field() expects the 2nd argument to be the delimiter character, and the 3rd argument to be the count, not vice versa.

A dynamic filename is specified with the option dynaFile= followed by the name of a template in double-quotes, eg:

template(name="logfile" type="string" string="/.../%$.key%")
set $.key = field($rawmsg-after-pri, 1, ";");
set $.msg = field($rawmsg, 2, ";");
action(type="omfile" dynaFile="logfile" template="debug_format")