Log Message Normalization Parser Module (pmnormalize)¶
Module Name: pmnormalize
Available since: 8.27.0
Author: Pascal Withopf <pascalwithopf1@gmail.com>
Description:
This parser normalizes messages with the specified rules and populates the properties for further use.
Action Parameters¶
Note: parameter names are case-insensitive.
-
rulebase <word>
Specifies which rulebase file is to use. If there are multiple pmnormalize instances, each one can use a different file. However, a single instance can use only a single file. This parameter or rule MUST be given, because normalization can only happen based on a rulebase. It is recommended that an absolute path name is given. Information on how to create the rulebase can be found in the liblognorm manual.
-
rule <array>
Contains an array of strings which will be put together as the rulebase. This parameter or rulebase MUST be given, because normalization can only happen based on a rulebase.
-
undefinedpropertyerror <on/off>
Default: off
With this parameter an error message is controlled, which will be put out every time pmnormalize can’t normalize a message.
See Also¶
Caveats/Known Bugs¶
None known at this time.
Example¶
Sample 1:
In this sample messages are received via imtcp. Then they are normalized with the given rulebase and written to a file.
module(load="imtcp")
module(load="pmnormalize")
input(type="imtcp" port="13514" ruleset="ruleset")
parser(name="custom.pmnormalize" type="pmnormalize" rulebase="/tmp/rules.rulebase")
ruleset(name="ruleset" parser="custom.pmnormalize") {
action(type="omfile" file="/tmp/output")
}
Sample 2:
In this sample messages are received via imtcp. Then they are normalized with the given rule array. After that they are written in a file.
module(load="imtcp")
module(load="pmnormalize")
input(type="imtcp" port="10514" ruleset="outp")
parser(name="custom.pmnormalize" type="pmnormalize" rule=[
"rule=:<%pri:number%> %fromhost-ip:ipv4% %hostname:word% %syslogtag:char-to:\\x3a%: %msg:rest%",
"rule=:<%pri:number%> %hostname:word% %fromhost-ip:ipv4% %syslogtag:char-to:\\x3a%: %msg:rest%"])
ruleset(name="outp" parser="custom.pmnormalize") {
action(type="omfile" File="/tmp/output")
}
See also
If you would like to contribute to these docs, but are unsure where to start, please see the rsyslog-doc project README for an overview of the process. If you would like to contribute to the main source project, please review the contribution guidelines listed in the rsyslog project README.
If you have a question about these docs or Rsyslog
in general, please
see the following resources: