rsyslog / liblognorm

a fast samples-based log normalization library
http://www.liblognorm.com
GNU Lesser General Public License v2.1
99 stars 64 forks source link

Legacy discard fields not working with certain field types #280

Closed friedl closed 6 years ago

friedl commented 6 years ago

When having a legacy rulebase running as version=2 and a rule uses "-" as field name to discard unused values, a rulebase error occurs for certain field types.

E.g. the field types number and date-rfc5424 cause these errors when the field content should not be saved.

The error looks like this: rsyslogd: liblognorm error: rulebase file /home/test/normalize.rb[23]: invalid param for number: name [v8.32.0 try http://www.rsyslog.com/e/2427 ]

A workaround for this is to use the current rulebase format instead of the legacy format or at least have the rulebase partially updated.

Example - not working:

version=2
rule=:<%-:number%>1 %-:date-rfc5424% %-:word% %umsg:rest%

Example - working:

version=2
rule=:<%{"type":"number"}%>1 %{"type":"date-rfc5424"}% %-:word% %umsg:rest%
solhuebner commented 6 years ago

@friedl #284 should fix that. You can also have a look at #270.

rgerhards commented 6 years ago

fixed via #284