I've got a device (aruba) that sends messages that contain | characters in a message field. It escapes them with a backslash (i.e. '|text|'), the cef parser doesn't handle this.
working on the command line (echoing 'rawmsg text'), if I change them from | to \| the parser works, but the resulting field has | in it.
but trying to parse the message in rsyslog is not working as a result
@marnao you have done some work on this parser in the past.
I've got a device (aruba) that sends messages that contain | characters in a message field. It escapes them with a backslash (i.e. '|text|'), the cef parser doesn't handle this.
working on the command line (echoing 'rawmsg text'), if I change them from | to \| the parser works, but the resulting field has | in it.
but trying to parse the message in rsyslog is not working as a result
@marnao you have done some work on this parser in the past.