No subject
Mon Jan 16 15:48:14 CET 2012
correct?
So I set it up to look for four(4) columns of data and to be "greedy" on
the last column.
I have played around with the number of columns and even used a rewrite
function instead. But the Parser continues to produce empty variables. And
my template just echos out my default value.
Any thoughts?
>
>
> parser p_et_logmessage {
> csv-parser(
> #columns("ETMSG")
> #columns("ETMSG.ISODATE")
> columns("ETMSG.ISODATE", "ETMSG.EASI", "ETMSG.SOURCE",
> "ETMSG.BODY")
> delimiters(" ")
> #template("${MSG}")
> flags(greedy)
> );
> };
>
> rewrite r_rewrite_set{set('${ETMSG.BODY:-nothing}', value("MESSAGE"));};
>
> template t_et_basic_logmessage {
> template("${ETMSG.BODY:-nothing}\n"); template_escape(no); }=
;
>
>
> destination destination_info {
> tcp("host2" port(8080)
> template(t_et_basic_logmessage)
> log_disk_fifo_size(32212254720)
> );
> };
>
> log {
> source(INTAKE);
> parser(p_et_logmessage);
> destination(destination_info);
> };
>
My latest Post: Givenchy Fall/Winter 2012 Collection =96 Runway |
Highsnobiety.com<http://www.webeclubbin.com/blog/2012/01/givenchy-fallwinte=
r-2012-collection-runway-highsnobiety-com/>
Get a signature like this.
<http://r1.wisestamp.com/r/landing?promo=3D19&dest=3Dhttp%3A%2F%2Fwww.wises=
tamp.com%2Femail-install%3Futm_source%3Dextension%26utm_medium%3Demail%26ut=
m_campaign%3Dpromo_19>
CLICK
HERE.<http://r1.wisestamp.com/r/landing?promo=3D19&dest=3Dhttp%3A%2F%2Fwww.=
wisestamp.com%2Femail-install%3Futm_source%3Dextension%26utm_medium%3Demail=
%26utm_campaign%3Dpromo_19>
--e89a8f13ec34d7884704b85060be
Content-Type: text/html; charset=windows-1252
Content-Transfer-Encoding: quoted-printable
I can only assume I am not implementing this correctly. :-)<div><br></div><=
div>But I have a parser I am trying to use so I can take a subset of the in=
formation of a message and send that subset to another=A0receiver.</div><di=
v>
This is the whole message:</div><div><br></div><blockquote class=3D"gmail_q=
uote" style=3D"margin-top:0px;margin-right:0px;margin-bottom:0px;margin-lef=
t:0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-lef=
t-style:solid;padding-left:1ex">
<div style><13>Feb=A0 4 18:40:17 myhost syslogng: 2012-02-04T18:40:17=
-08:00 myhostserver-http /tmp/logs/access_log=A0=A0=A0 Hi Mom</div></blockq=
uote><div><br></div><div>What I want to do is send out the message as :</di=
v><div>
<br></div><blockquote class=3D"gmail_quote" style=3D"margin-top:0px;margin-=
right:0px;margin-bottom:0px;margin-left:0.8ex;border-left-width:1px;border-=
left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><span=
style><13>Feb=A0 4 18:40:17 myhost syslogng: Hi Mom</span></blockquo=
te>
<div>=A0</div><div>Notice how I dropped the middle part out.</div><div><br>=
</div><div>From what I have read, the parser acts on the message body alone=
. Is this correct?</div><div>So I set it up to look for four(4) columns of =
data and to be "greedy" on the last column.</div>
<div><br></div><div>I have played around with the number of columns and eve=
n used a rewrite function instead. But the Parser continues to produce empt=
y variables. =A0And my template just echos out my default value.</div><div>
<br></div><div>Any thoughts? =A0</div><div><br></div><div><br></div><blockq=
uote class=3D"gmail_quote" style=3D"margin-top:0px;margin-right:0px;margin-=
bottom:0px;margin-left:0.8ex;border-left-width:1px;border-left-color:rgb(20=
4,204,204);border-left-style:solid;padding-left:1ex">
<div style>=A0</div><div style><br></div><div style>=A0</div><div style>=A0=
<span style=3D"color:rgb(31,73,125)">parser p_et_logmessage {</span></div><=
div style><font color=3D"#1F497D">=A0=A0=A0=A0=A0=A0=A0 csv-parser(</font><=
/div><div style><font color=3D"#1F497D">=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 #co=
lumns("ETMSG")</font></div>
<div style><font color=3D"#1F497D">=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=
=A0=A0 #columns("ETMSG.ISODATE")</font></div><div style><font col=
or=3D"#1F497D">=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 columns("ETMSG.ISODATE&=
quot;, "ETMSG.EASI", "ETMSG.SOURCE", "ETMSG.BODY&q=
uot;)</font></div>
<div style><font color=3D"#1F497D">=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=
=A0=A0 delimiters(" ")</font></div><div style><font color=3D"#1F4=
97D">=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0 #template("${MSG}&q=
uot;)</font></div><div style><font color=3D"#1F497D">=A0=A0=A0=A0=A0=A0=A0=
=A0=A0=A0=A0=A0=A0=A0=A0 flags(greedy)</font></div>
<div style><font color=3D"#1F497D">=A0=A0=A0=A0=A0=A0=A0 );</font></div><di=
v style><font color=3D"#1F497D">};</font></div></blockquote><div>=A0</div><=
blockquote class=3D"gmail_quote" style=3D"margin-top:0px;margin-right:0px;m=
argin-bottom:0px;margin-left:0.8ex;border-left-width:1px;border-left-color:=
rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div style><font color=3D"#1F497D">rewrite r_rewrite_set{set('${ETMSG.B=
ODY:-nothing}', value("MESSAGE"));};</font></div><div style><=
font color=3D"#1F497D">=A0</font></div><div style><font color=3D"#1F497D">t=
emplate t_et_basic_logmessage {</font></div>
<div style><font color=3D"#1F497D">=A0 =A0 =A0 =A0 =A0 =A0 =A0template(&quo=
t;${ETMSG.BODY:-nothing}\n"); template_escape(no); };</font></div><div=
style><font color=3D"#1F497D">=A0 =A0 =A0 =A0 =A0 =A0 =A0</font></div><div=
style><font color=3D"#1F497D">=A0</font></div>
<div style>destination destination_info {</div><div style>=A0=A0=A0=A0=A0=
=A0=A0 tcp("host2" port(8080)</div><div style>=A0 =A0 =A0 =A0 =A0=
=A0 =A0 =A0 template(t_et_basic_logmessage)</div><div style>=A0=A0=A0=A0=
=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0 log_disk_fifo_size(32212254720)</div>
<div style>=A0=A0=A0=A0=A0=A0=A0 );</div><div style>};</div><div style>=A0<=
/div><div style>log {</div><div style>=A0=A0=A0=A0=A0=A0=A0 source(INTAKE);=
</div><div style>=A0=A0=A0=A0=A0=A0=A0 parser(p_et_logmessage);</div><div s=
tyle>=A0=A0=A0=A0=A0=A0=A0 destination(destination_info);</div>
<div style>};</div></blockquote><div><br></div><div><br><br><div id=3D"WISE=
STAMP_SIG_8362"><div style=3D"font-size:13.3px;font-family:Verdana,Arial,He=
lvetica,sans-serif">
<div style=3D"max-width:469px;padding:0.5em 0 0.5em"><span style=3D"font=
-size:90%"><span style=3D"color:gray">My latest Post: </span> <a href=3D"h=
ttp://www.webeclubbin.com/blog/2012/01/givenchy-fallwinter-2012-collection-=
runway-highsnobiety-com/"><span style=3D"color:#00e;text-decoration:underli=
ne">Givenchy Fall/Winter 2012 Collection =96 Runway | Highsnobiety.com</spa=
n></a></span><br>
</div>
<div style=3D"width:auto;padding-top:2px;font-size:70%;border-top:1px so=
lid #eeeeee;margin-top:10px">
<a style=3D"color:#6f6f6f;text-decoration:none" href=3D"http://r1.wises=
tamp.com/r/landing?promo=3D19&dest=3Dhttp%3A%2F%2Fwww.wisestamp.com%2Fe=
mail-install%3Futm_source%3Dextension%26utm_medium%3Demail%26utm_campaign%3=
Dpromo_19">
<span style=3D"color:#6f6f6f">Get a signature like this.</span>
</a>
<span style=3D"color:#3f48cc"><a style=3D"color:#3f48cc" href=3D"http:/=
/r1.wisestamp.com/r/landing?promo=3D19&dest=3Dhttp%3A%2F%2Fwww.wisestam=
p.com%2Femail-install%3Futm_source%3Dextension%26utm_medium%3Demail%26utm_c=
ampaign%3Dpromo_19">CLICK HERE.</a></span>
<img border=3D"0" width=3D"1" height=3D"1" src=3D"http://pr1.wisestamp.=
com/p.gif?promo=3D19">
=A0
</div>
<img src=3D"https://wisestamp.appspot.com/pixel.png?p=3Dchrome&v=3D3.=
11.13.0&t=3D1328552726322&u=3Db3aba1170c4ca423" width=3D"1" height=
=3D"1"></div></div></div>
--e89a8f13ec34d7884704b85060be--
More information about the syslog-ng
mailing list