Mailing List Archive

how to alter "msg" property with function replace()
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: how to alter "msg" property with function replace() [ In reply to ]
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: how to alter "msg" property with function replace() [ In reply to ]
HI
default properties like msg rawmsg ... are readonly and you cannot change
them, use should use custom variables like: $.<varname> or $!<varname>
then use templates to form output string and send it to destination/file.

set $.myvar = $msg;
set $.myvar = replace( $.myvar, 'this', 'that' );
action( ... template="" )


On Wed, Dec 30, 2020 at 2:45 PM Gi Actor via rsyslog <
rsyslog@lists.adiscon.com> wrote:

>
> _______________________________________________
> rsyslog mailing list
> https://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
> DON'T LIKE THAT.
>
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: how to alter "msg" property with function replace() [ In reply to ]
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: how to alter "msg" property with function replace() [ In reply to ]
This is interesting! Thank you very much indeed!

But how will I mention custom variables in templates?
Will you please share an example?

Mine now looks like below:

template (name="PolKit" type="list") {
property(name="timereported" dateFormat="year")
constant(value=" ")
property(name="timereported" dateFormat="month")
constant(value=" ")
property(name="timereported" dateFormat="day")
constant(value=" ")
...
}

But I'm perplexed how to finish it with the custom variables.

Basically the rsyslog configuration is like below:

if ($programname == 'polkitd' then {
reset $msg = replace($msg, 'etc', '');
action)type="omfile" file="/var/log/polkit.log" template="PolKit"
stop
}
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: how to alter "msg" property with function replace() [ In reply to ]
see
https://www.rsyslog.com/doc/v8-stable/rainerscript/variable_property_types.html

in the template, instead of msg you would use $.msg or $!msg (whichever you opt
to use)

and then you would do
set $!msg = replace($msg, 'etc', '');

or
set $.msg = replace($msg, 'etc', '');

let us know if you have more questions

David Lang

On Wed, 30 Dec 2020, Gi Actor via rsyslog wrote:

> Date: Wed, 30 Dec 2020 23:51:20 +0300
> From: Gi Actor via rsyslog <rsyslog@lists.adiscon.com>
> To: rsyslog-users <rsyslog@lists.adiscon.com>
> Cc: Gi Actor <gactor@yandex.ua>
> Subject: Re: [rsyslog] how to alter "msg" property with function replace()
>
> This is interesting! Thank you very much indeed!
>
> But how will I mention custom variables in templates?
> Will you please share an example?
>
> Mine now looks like below:
>
> template (name="PolKit" type="list") {
> property(name="timereported" dateFormat="year")
> constant(value=" ")
> property(name="timereported" dateFormat="month")
> constant(value=" ")
> property(name="timereported" dateFormat="day")
> constant(value=" ")
> ...
> }
>
> But I'm perplexed how to finish it with the custom variables.
>
> Basically the rsyslog configuration is like below:
>
> if ($programname == 'polkitd' then {
> reset $msg = replace($msg, 'etc', '');
> action)type="omfile" file="/var/log/polkit.log" template="PolKit"
> stop
> }
> _______________________________________________
> rsyslog mailing list
> https://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
>
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: how to alter "msg" property with function replace() [ In reply to ]
Thank you, truly appreciate! With your help I've managed to implement the logic.

template (name="PolKit" type="list") {
property(name="timereported" dateFormat="year")
constant(value=" ")
property(name="timereported" dateFormat="month")
constant(value=" ")
property(name="timereported" dateFormat="day")
constant(value=" ")
property(name="$!msg" spifno1stsp="on")
property(name="$!msg" droplastif="on")
constant(value="\n")
}


if ($programname == 'polkitd' then {
set $!msg = replace($msg, '/etc/polkit-1/rules.d/', '');
action(type="omfile" file="/var/log/polkit.log" template="PolKit")
stop
}

_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.