mirror of
https://github.com/rsyslog/rsyslog.git
synced 2025-12-13 04:50:41 +01:00
c902a0938f
This adds support for endmsg.regex. It is similar to
startmsg.regex except that it matches the line that denotes
the end of the message, rather than the start of the next message.
This is primarily for container log file use cases such as this:
date stdout P start of message
date stdout P middle of message
date stdout F end of message
The `F` means this is the line which contains the final part of
the message. The fully assembled message should be
`start of message middle of message end of message`.
`startmsg.regex="^[^ ]+ stdout F "` will match.
10 lines
312 B
Plaintext
10 lines
312 B
Plaintext
version=2
|
|
rule=:%{"name":"multilinejson", "type":"repeat", "option.permitMismatchInParser": true,
|
|
"parser":[
|
|
{"type":"json", "name":"."}
|
|
],
|
|
"while":[
|
|
{"type":"char-sep", "extradata":"{"}
|
|
]
|
|
}%
|