diff options
Diffstat (limited to 'doc/property_replacer.html')
| -rw-r--r-- | doc/property_replacer.html | 23 |
1 files changed, 17 insertions, 6 deletions
diff --git a/doc/property_replacer.html b/doc/property_replacer.html index 9bd77cec..c45486e8 100644 --- a/doc/property_replacer.html +++ b/doc/property_replacer.html @@ -79,14 +79,23 @@ return the part of the property text that matches the regular expression. An example for a property replacer sequence with a regular expression is: "%msg:R:.*Sev:. \(.*\) \[.*--end%"<br> <p> -<b>Also, extraction can be done based on so-called "fields"</b>. To do so, place
a "F" into FromChar. A field in its current definition is anything that is
delimited by a delimiter character. The delimiter by default is TAB (US-ASCII value 9). -However, if can be changed to any other US-ASCII character by specifying a comma -and teh <b>decimal</b> US-ASCII value of the delimiter immediately after the +<b>Also, extraction can be done based on so-called "fields"</b>. To do so, place +a "F" into FromChar. A field in its current definition is anything +that is delimited by a delimiter character. The delimiter by default is TAB +(US-ASCII value 9). However, if can be changed to any other US-ASCII character +by specifying a comma and the <b>decimal</b> US-ASCII value of the delimiter immediately after the "F". For example, to use comma (",") as a delimiter, use this field specifier: -"F,44". If your syslog data is delimited,
this is a quicker way to extract than via regular expressions (actually, a *much*
quicker way). Field counting starts at 1. Field zero is accepted, but will
always lead to a "field not found" error. The same happens if a field number
higher than the number of fields in the property is requested. The field number
must be placed in the "ToChar" parameter. An example where the 3rd field -(delimited by TAB) from
the msg property is extracted is as follows: "%msg:F:3%". The same +"F,44". If your syslog data is delimited, +this is a quicker way to extract than via regular expressions (actually, a *much* +quicker way). Field counting starts at 1. Field zero is accepted, but will +always lead to a "field not found" error. The same happens if a field number +higher than the number of fields in the property is requested. The field number +must be placed in the "ToChar" parameter. An example where the 3rd field +(delimited by TAB) from +the msg property is extracted is as follows: "%msg:F:3%". The same example with semicolon as delimiter is "%msg:F,59:3%".<p> -Please note that the special characters "F" and "R" are case-sensitive. Only
upper case works, lower case will return an error. There are no white spaces +Please note that the special characters "F" and "R" are case-sensitive. Only +upper case works, lower case will return an error. There are no white spaces permitted inside the sequence (that will lead to error messages and will NOT provide the intended result).<br> <h2>Property Options</h2> @@ -115,6 +124,8 @@ are defined:</p> <li>Article on "<a href="rsyslog_recording_pri.html">Recording the Priority of Syslog Messages</a>" (describes use of templates to record severity and facility of a message)</li> + <li><a href="rsyslog_conf.html">Configuration file syntax</a>, this is where you + actually use the property replacer.</li> </ul> </body> |