summaryrefslogtreecommitdiffstats
path: root/doc/property_replacer.html
diff options
context:
space:
mode:
authorRainer Gerhards <rgerhards@adiscon.com>2006-09-27 16:04:57 +0000
committerRainer Gerhards <rgerhards@adiscon.com>2006-09-27 16:04:57 +0000
commit189fc4defd88887e6055029c5ca7833f64f11915 (patch)
tree42ca274357a53a4fcfe3e2e1779c4b8214458ca3 /doc/property_replacer.html
parent64dc3591f4cd8a7eab27d689f2b8f5db4eb56517 (diff)
downloadrsyslog-189fc4defd88887e6055029c5ca7833f64f11915.tar.gz
rsyslog-189fc4defd88887e6055029c5ca7833f64f11915.tar.xz
rsyslog-189fc4defd88887e6055029c5ca7833f64f11915.zip
updated doc to reflect new field-delimiter configuration capability
Diffstat (limited to 'doc/property_replacer.html')
-rw-r--r--doc/property_replacer.html12
1 files changed, 10 insertions, 2 deletions
diff --git a/doc/property_replacer.html b/doc/property_replacer.html
index 10dba469..32cfceec 100644
--- a/doc/property_replacer.html
+++ b/doc/property_replacer.html
@@ -60,8 +60,16 @@ return the part of the property text that matches the regular expression. An
example for a property replacer sequence with a regular expression is: &quot;%msg:R:.*Sev:.
\(.*\) \[.*--end%&quot;<br>
<p>
-<b>Also, extraction can be done based on so-called &quot;fields&quot;</b>. To do so, place a &quot;F&quot; into FromChar. A field in its current definition is anything that is delemited by TAB characters (US-ASCII value 9). If your syslog data is tabular, this is a quicker way to extract than via regular expressions (actually, a *much* quicker way). Field counting starts at 1. Field zero is accepted, but will always lead to a &quot;field not found&quot; error. The same happens if a field number higher than the number of fields in the property is requested. The field number must be placed in the &quot;ToChar&quot; parameter. An example where the 3rd field from the msg property is extracted is as follows: &quot;%msg:F:3%&quot;.<p>
-Please note that the special characters &quot;F&quot; and &quot;R&quot; are case-sensitive. Only upper case works, lower case will return an error.<br>
+<b>Also, extraction can be done based on so-called &quot;fields&quot;</b>. To do so, place a &quot;F&quot; into FromChar. A field in its current definition is anything that is delimited by a delimiter character. The delimiter by default is TAB (US-ASCII value 9).
+However, if can be changed to any other US-ASCII character by specifying a comma
+and teh <b>decimal</b> US-ASCII value of the delimiter immediately after the
+&quot;F&quot;. For example, to use comma (&quot;,&quot;) as a delimiter, use this field specifier:
+&quot;F,44&quot;.&nbsp; If your syslog data is delimited, this is a quicker way to extract than via regular expressions (actually, a *much* quicker way). Field counting starts at 1. Field zero is accepted, but will always lead to a &quot;field not found&quot; error. The same happens if a field number higher than the number of fields in the property is requested. The field number must be placed in the &quot;ToChar&quot; parameter. An example where the 3rd field
+(delimited by TAB) from the msg property is extracted is as follows: &quot;%msg:F:3%&quot;. The same
+example with semicolon as delimiter is &quot;%msg:F,59:3%&quot;.<p>
+Please note that the special characters &quot;F&quot; and &quot;R&quot; are case-sensitive. Only upper case works, lower case will return an error. There are no white spaces
+permitted inside the sequence (that will lead to error messages and will NOT
+provide the intended result).<br>
<h2>Property Options</h2>
<b><code>property options</code></b> are case-insensitive. Currently, the following options
are defined:</p>