it's unfortunately common to have logs that differ only in having whitespace or having a literal.
even rsyslog has problems with this, if you generate a traditional formatted message, the syslogtag will have a : on it if the inbound log was an old-style message, but not if the inbound log was a rfc5424 message.
I have many logs that I receive that sometimes have a space at the beginning of the message and sometimes don't
if there is a varying amount of whitespace, that is easy to deal with, but there's no option to say '0 or more whitespace characters'
I've tried doing custom types with alternates to allow ': ' or ' ' to deal with the : there or not, and it hasn't worked well
it's unfortunately common to have logs that differ only in having whitespace or having a literal.
even rsyslog has problems with this, if you generate a traditional formatted message, the syslogtag will have a : on it if the inbound log was an old-style message, but not if the inbound log was a rfc5424 message.
I have many logs that I receive that sometimes have a space at the beginning of the message and sometimes don't
if there is a varying amount of whitespace, that is easy to deal with, but there's no option to say '0 or more whitespace characters'
I've tried doing custom types with alternates to allow ': ' or ' ' to deal with the : there or not, and it hasn't worked well