Mailing List Archive: Change message content with imfile

Hi,

I'm trying to forward RabbitMQ server logs to /var/log/syslog. If gotten
this far:

cat /etc/rsyslog.d/98-rabbitmq.conf
module(load="imfile")
input(type="imfile"
File="/var/log/rabbitmq/rabbit@ip-172-31-2-168.log"
Tag="rabbitmq:"
Severity="info"
readMode="1"
PersistStateInterval="0"
escapeLF="off"
reopenOnTruncate="on")

But now I want to strip some text from the message. I've spent a few hours
googling on how to do this but I can't find a suitable solution.

I think I should use the property replacer (?) so I created one that does
the job:
%msg:R,ERE,0,DFLT:[[:space:]]===[[:space:]].*--end%\n

But how can I apply it only to the log lines read from the file above?

Thanks,

Anders
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

On Thu, 17 Jan 2019, Anders B?lter via rsyslog wrote:

> I think I should use the property replacer (?) so I created one that does
> the job:
> %msg:R,ERE,0,DFLT:[[:space:]]===[[:space:]].*--end%\n
>
> But how can I apply it only to the log lines read from the file above?

you can't change the message you read, what you do is change the message that
you write by creating a template and using that when you output the message

David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.