rsyslog / liblognorm

a fast samples-based log normalization library
http://www.liblognorm.com
GNU Lesser General Public License v2.1
99 stars 64 forks source link

Unable to read data contains different white space length #281

Closed dpkkumar01 closed 6 years ago

dpkkumar01 commented 6 years ago

I have the log file which will write the data separated by white space. White space length is different for each line.

My data looks like below,

IN-DL 34 4545 Success IN-CHN 54 8 Fail

Please help me to read these data. Thanks in advance.

davidelang commented 6 years ago

There is the whitespace type avaialable for exactly that use case.

David Lang

dpkkumar01 commented 6 years ago

Thanks for the update David,

I have tried that option, But i am unable to use that properly. May be i am not correct.

Can you please help me with sample syntax for the below lines. IN-DL 34 4545 Success IN-CHN 54 8 Fail

Thanks in advance.

davidelang commented 6 years ago

can you post the rule that you have attempted to use?

On Mon, 12 Feb 2018, dpkkumar01 wrote:

Can you please help me with sample syntax for the below lines. IN-DL 34 4545 Success IN-CHN 54 8 Fail

dpkkumar01 commented 6 years ago

Hi David, I was tried with the below syntax to split the data. rule=testing:%Name:word%%space1:whitespace%Req:word%%space2:whitespace%Req_Succ:word%%space3:whitespace%status:word%

I have gone through some other examples and corrected the syntax like below. Now i am able to read the message with the below syntax. rule=testing:%Name:word%%-:whitespace%%Req:word%%-:whitespace%%Req_Succ:word%%-:whitespace%%status:word%

Thanks for your help.