Hi Rsyslog Team,
We are planning to call mmnormalize multiple times for a message,
action(type="mmnormalize"
ruleBase="/etc/rsyslog.d/container_log_parse.rulebase" path="$!parsedmsg")
set $!msg = $!parsedmsg!log;
.......
.......
action(type="mmnormalize" rule=["rule=:%severity:word% %message:rest%"]
path="$!normalized_msg" variable="$!msg")
We found that, its working perfectly fine. However in docs
<https://www.rsyslog.com/doc/v8-stable/configuration/modules/mmnormalize.html>,
it says
"Note that mmnormalize should only be called once on each message.
Behaviour is undefined if multiple calls to mmnormalize happen for the same
message."
Couldn't understand completely what the statement means and the reasoning
behind it. Can we use mmnormalize like above or we should replace one of
mmnormalize functionality with other functions ? (we are using first
mmnormalize to split the message into multiple fields using space
delimiter. So, we can use re_extract function or property replacers or some
other function)
--
Regards,
Rajesh KSV
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
We are planning to call mmnormalize multiple times for a message,
action(type="mmnormalize"
ruleBase="/etc/rsyslog.d/container_log_parse.rulebase" path="$!parsedmsg")
set $!msg = $!parsedmsg!log;
.......
.......
action(type="mmnormalize" rule=["rule=:%severity:word% %message:rest%"]
path="$!normalized_msg" variable="$!msg")
We found that, its working perfectly fine. However in docs
<https://www.rsyslog.com/doc/v8-stable/configuration/modules/mmnormalize.html>,
it says
"Note that mmnormalize should only be called once on each message.
Behaviour is undefined if multiple calls to mmnormalize happen for the same
message."
Couldn't understand completely what the statement means and the reasoning
behind it. Can we use mmnormalize like above or we should replace one of
mmnormalize functionality with other functions ? (we are using first
mmnormalize to split the message into multiple fields using space
delimiter. So, we can use re_extract function or property replacers or some
other function)
--
Regards,
Rajesh KSV
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.