<p>I think I found the issue. I define the parser once, but i use it in two different log statments.</p>
<p>When i use it twice the parser places blanks in the custom columns. If i only use it once everything works and the custom columns have the right values.</p>
<p>Expect behavior?</p>
<div class="gmail_quote">On Feb 6, 2012 11:37 AM, "T. A. Smooth" <<a href="mailto:catdaaaady@gmail.com">catdaaaady@gmail.com</a>> wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Okay this is really weird. Sorry again.<br>
I pasted contents of the email here with the configuration .<br>
Hopefully this is not too much of a inconvenience.<br>
<br>
<a href="http://pastebin.com/YQUD5TrA" target="_blank">http://pastebin.com/YQUD5TrA</a><br>
<br>
<br>
On Mon, Feb 6, 2012 at 11:27 AM, T. A. Smooth <<a href="mailto:catdaaaady@gmail.com">catdaaaady@gmail.com</a>> wrote:<br>
> Looks like my last email was chopped off .<br>
> Here it is again.<br>
> ################<br>
><br>
> I can only assume I am not implementing this correctly. :-)<br>
><br>
> But I have a parser I am trying to use so I can take a subset of the<br>
> information of a message and send that subset to another receiver.<br>
> This is the whole message:<br>
><br>
> <13>Feb 4 18:40:17 myhost syslogng: 2012-02-04T18:40:17-08:00<br>
> myhostserver-http /tmp/logs/access_log Hi Mom<br>
><br>
> What I want to do is send out the message as :<br>
><br>
> <13>Feb 4 18:40:17 myhost syslogng: Hi Mom<br>
><br>
> Notice how I dropped the middle part out.<br>
><br>
> From what I have read, the parser acts on the message body alone. Is<br>
> this correct?<br>
> So I set it up to look for four(4) columns of data and to be "greedy"<br>
> on the last column.<br>
><br>
> I have played around with the number of columns and even used a<br>
> rewrite function instead. But the Parser continues to produce empty<br>
> variables. And my template just echos out my default value.<br>
><br>
> Any thoughts?<br>
><br>
><br>
><br>
><br>
><br>
> parser p_et_logmessage {<br>
> csv-parser(<br>
> #columns("ETMSG")<br>
> #columns("ETMSG.ISODATE")<br>
> columns("ETMSG.ISODATE", "ETMSG.EASI", "ETMSG.SOURCE",<br>
> "ETMSG.BODY")<br>
> delimiters(" ")<br>
> #template("${MSG}")<br>
> flags(greedy)<br>
> );<br>
> };<br>
><br>
> rewrite r_rewrite_set{set('${ETMSG.BODY:-nothing}', value("MESSAGE"));};<br>
><br>
> template t_et_basic_logmessage {<br>
> template("${ETMSG.BODY:-nothing}\n"); template_escape(no); };<br>
><br>
><br>
> destination destination_info {<br>
> tcp("host2" port(8080)<br>
> template(t_et_basic_logmessage)<br>
> log_disk_fifo_size(32212254720)<br>
> );<br>
> };<br>
><br>
> log {<br>
> source(INTAKE);<br>
> parser(p_et_logmessage);<br>
> destination(destination_info);<br>
> };<br>
><br>
><br>
><br>
><br>
><br>
><br>
><br>
><br>
> On Mon, Feb 6, 2012 at 11:07 AM, T. A. Smooth <<a href="mailto:catdaaaady@gmail.com">catdaaaady@gmail.com</a>> wrote:<br>
>><br>
>> I can only assume I am not implementing this correctly. :-)<br>
>><br>
>> But I have a parser I am trying to use so I can take a subset of the information of a message and send that subset to another receiver.<br>
>> This is the whole message:<br>
>><br>
>>> <13>Feb 4 18:40:17 myhost syslogng: 2012-02-04T18:40:17-08:00 myhostserver-http /tmp/logs/access_log Hi Mom<br>
>><br>
>><br>
>> What I want to do is send out the message as :<br>
>><br>
>>> <13>Feb 4 18:40:17 myhost syslogng: Hi Mom<br>
>><br>
>><br>
>> Notice how I dropped the middle part out.<br>
>><br>
>> From what I have read, the parser acts on the message body alone. Is this correct?<br>
>> So I set it up to look for four(4) columns of data and to be "greedy" on the last column.<br>
>><br>
>> I have played around with the number of columns and even used a rewrite function instead. But the Parser continues to produce empty variables. And my template just echos out my default value.<br>
>><br>
>> Any thoughts?<br>
>><br>
>><br>
>>><br>
>>><br>
>>><br>
>>> parser p_et_logmessage {<br>
>>> csv-parser(<br>
>>> #columns("ETMSG")<br>
>>> #columns("ETMSG.ISODATE")<br>
>>> columns("ETMSG.ISODATE", "ETMSG.EASI", "ETMSG.SOURCE", "ETMSG.BODY")<br>
>>> delimiters(" ")<br>
>>> #template("${MSG}")<br>
>>> flags(greedy)<br>
>>> );<br>
>>> };<br>
>><br>
>><br>
>>><br>
>>> rewrite r_rewrite_set{set('${ETMSG.BODY:-nothing}', value("MESSAGE"));};<br>
>>><br>
>>> template t_et_basic_logmessage {<br>
>>> template("${ETMSG.BODY:-nothing}\n"); template_escape(no); };<br>
>>><br>
>>><br>
>>> destination destination_info {<br>
>>> tcp("host2" port(8080)<br>
>>> template(t_et_basic_logmessage)<br>
>>> log_disk_fifo_size(32212254720)<br>
>>> );<br>
>>> };<br>
>>><br>
>>> log {<br>
>>> source(INTAKE);<br>
>>> parser(p_et_logmessage);<br>
>>> destination(destination_info);<br>
>>> };<br>
>><br>
>><br>
>><br>
>><br>
>> My latest Post: Givenchy Fall/Winter 2012 Collection – Runway | Highsnobiety.com<br>
>> Get a signature like this. CLICK HERE.<br>
</blockquote></div>