Mailing List Archive: Splitting a log message in multiple fields

Hello!
I am trying to split an incoming log message in multiple fields using
rsyslog (Rainerscript). The log message has an unconventional structure,
something like:

Field1 [Tab] Field2 [Tab][Tab] Field3 [Tab][Tab][Tab] Field4

How can I extract every field and assign it to a local variable,
considering some fields are delimited by multiple [Tab] characters? I tried
using the field() function, but that will ignore just the first [Tab]
character.

Thanks!
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

look at the mmnormalize module.

David Lang

On Tue, 24 Sep 2019, Claudiu Stanculescu via rsyslog wrote:

> Date: Tue, 24 Sep 2019 07:38:34 +0300
> From: Claudiu Stanculescu via rsyslog <rsyslog@lists.adiscon.com>
> To: rsyslog@lists.adiscon.com
> Cc: Claudiu Stanculescu <claudiu.edi97@gmail.com>
> Subject: [rsyslog] Splitting a log message in multiple fields
>
> Hello!
> I am trying to split an incoming log message in multiple fields using
> rsyslog (Rainerscript). The log message has an unconventional structure,
> something like:
>
> Field1 [Tab] Field2 [Tab][Tab] Field3 [Tab][Tab][Tab] Field4
>
> How can I extract every field and assign it to a local variable,
> considering some fields are delimited by multiple [Tab] characters? I tried
> using the field() function, but that will ignore just the first [Tab]
> character.
>
> Thanks!
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
>
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.