mirror of
https://github.com/rsyslog/rsyslog.git
synced 2025-12-16 11:00:41 +01:00
79 lines
4.7 KiB
HTML
79 lines
4.7 KiB
HTML
<html>
|
|
<head>
|
|
<title>The Rsyslogd Property Replacer</title>
|
|
</head>
|
|
<body>
|
|
<h1>The Property Replacer</h1>
|
|
<p><b>The property replacer is a core component in rsyslogd's output system.</b>
|
|
A syslog message has a number of well-defined properties (see below). Each of
|
|
this properties can be accessed <b>and</b> manipulated by the property replacer.
|
|
With it, it is easy to use only part of a property value or manipulate the value,
|
|
e.g. by converting all characters to lower case.</p>
|
|
<h1>Accessing Properties</h1>
|
|
<p>Syslog message properties are used inside templates. They are accessed by putting them between percent signs. Properties can be modified by
|
|
the property replacer. The full syntax is as follows:</p>
|
|
<blockquote><b><code>%propname:fromChar:toChar:options%</code></b></blockquote>
|
|
<h2>Available Properties</h2>
|
|
<p><b><code>propname</code></b> is the name of the property to access. It is case-sensitive.
|
|
Currently supported are:</p>
|
|
<table>
|
|
<tr><td><b>msg</b></td><td>the MSG part of the message (aka "the message" ;))</td></tr>
|
|
<tr><td><b>rawmsg</b></td><td>the message excactly as it was received from the
|
|
socket. Should be useful for debugging.</td></tr>
|
|
<tr><td><b>UxTradMsg</b></td><td>will disappear soon - do NOT use!</td></tr>
|
|
<tr><td><b>HOSTNAME</b></td><td>hostname from the message</td></tr>
|
|
<tr><td><b>source</b></td><td>alias for HOSTNAME</td></tr>
|
|
<tr><td><b>FROMHOST</b></td><td>hostname of the system the message was received
|
|
from (in a relay chain, this is the system immediately in front of us and
|
|
not necessarily the original sender)</td></tr>
|
|
<tr><td><b>syslogtag</b></td><td>TAG from the message</td></tr>
|
|
<tr><td><b>programname</b></td><td>the "static" part of the tag, as defined by
|
|
BSD syslogd. For example, when TAG is "named[12345]", programname is "named".</td></tr>
|
|
<tr><td><b>PRI</b></td><td>PRI part of the message - undecoded (single value)</td></tr>
|
|
<tr><td><b>IUT</b></td><td>the monitorware InfoUnitType - used when talking
|
|
to a <a href="http://www.monitorware.com">MonitorWare</a> backend (also for
|
|
<a href="http://www.phplogcon.org/">phpLogCon</a>)</td></tr>
|
|
<tr><td><b>syslogfacility</b></td><td>the facility from the message - in numerical form</td></tr>
|
|
<tr><td><b>syslogpriority</b></td><td>the priority (actully severity!) from the
|
|
message - in numerical form</td></tr>
|
|
<tr><td><b>timegenerated</b></td><td>timestamp when the message was RECEIVED. Always in
|
|
high resolution</td></tr>
|
|
<tr><td><b>timereported</b></td><td>timestamp from the message. Resolution depends on
|
|
what was provided in the message (in most cases,
|
|
only seconds)</td></tr>
|
|
<tr><td><b>TIMESTAMP</b></td><td>alias for timereported</td></tr>
|
|
</table>
|
|
<h2>Character Positions</h2>
|
|
<p><b><code>FromChar</code></b> and <b><code>toChar</code></b> are used to build substrings. They specify the offset within
|
|
the string that should be copied. Offset counting starts at 1, so if you need to
|
|
obtain the first 2 characters of the message text, you can use this syntax:
|
|
"%msg:1:2%". If you do not whish to specify from and to, but you want to specify
|
|
options, you still need to include the colons. For example, if you would like to
|
|
convert the full message text to lower case, use "%msg:::lowercase%".<p>
|
|
There is also support for <b>regular expressions</b>. To use them, you need to
|
|
place a "R" into FromChar. This tells rsyslog that a regular expression instead
|
|
of position-based extraction is desired. The actual regular expression must then
|
|
be provided in toChar. The regular expression <b>must</b> be followed by the
|
|
string "--end". It denotes the end of the regular expression and will not become
|
|
part of it. If you are using regular expressions, the property replacer will
|
|
return the part of the property text that matches the regular expression. An
|
|
example for a property replacer sequence with a regular expression is: "%msg:R:.*Sev:.
|
|
\(.*\) \[.*--end%"<br>
|
|
<br>
|
|
<h2>Property Options</h2>
|
|
<b><code>property options</code></b> are case-insensitive. Currently, the following options
|
|
are defined:</p>
|
|
<table>
|
|
<tr><td><b>uppercase</b></td><td>convert property to lowercase only</td></tr>
|
|
<tr><td><b>lowercase</b></td><td>convert property text to uppercase only</td></tr>
|
|
<tr><td><b>drop-last-lf</b></td><td>The last LF in the message (if any), is dropped.
|
|
Especially useful for PIX.</td></tr>
|
|
<tr><td><b>date-mysql</b></td><td>format as mysql date</td></tr>
|
|
<tr><td><b>date-rfc3164</b></td><td>format as RFC 3164 date</td></tr>
|
|
<tr><td><b>date-rfc3339</b></td><td>format as RFC 3339 date</td></tr>
|
|
<tr><td><b>escape-cc</b></td><td>NOT yet implemented</td></tr>
|
|
</table>
|
|
|
|
</body>
|
|
</html>
|