When having a legacy rulebase running as version=2 and a rule uses "-" as field name to discard unused values, a rulebase error occurs for certain field types.
E.g. the field types number and date-rfc5424 cause these errors when the field content should not be saved.
The error looks like this:
rsyslogd: liblognorm error: rulebase file /home/test/normalize.rb[23]: invalid param for number: name [v8.32.0 try http://www.rsyslog.com/e/2427 ]
A workaround for this is to use the current rulebase format instead of the legacy format or at least have the rulebase partially updated.
When having a legacy rulebase running as
version=2
and a rule uses "-" as field name to discard unused values, a rulebase error occurs for certain field types.E.g. the field types
number
anddate-rfc5424
cause these errors when the field content should not be saved.The error looks like this:
rsyslogd: liblognorm error: rulebase file /home/test/normalize.rb[23]: invalid param for number: name [v8.32.0 try http://www.rsyslog.com/e/2427 ]
A workaround for this is to use the current rulebase format instead of the legacy format or at least have the rulebase partially updated.
Example - not working:
Example - working: