Log Message Normalization Parser Module (pmnormalize)¶
Module Name: pmnormalize
Available since: 8.27.0
Author: Pascal Withopf <pascalwithopf1@gmail.com>
Description:
This parser normalizes messages with the specified rules and populates the properties for further use.
Action Parameters¶
Note: parameter names are case-insensitive.
-
rulebase <word>
Specifies which rulebase file is to use. If there are multiple pmnormalize instances, each one can use a different file. However, a single instance can use only a single file. This parameter or rule MUST be given, because normalization can only happen based on a rulebase. It is recommended that an absolute path name is given. Information on how to create the rulebase can be found in the liblognorm manual.
-
rule <array>
Contains an array of strings which will be put together as the rulebase. This parameter or rulebase MUST be given, because normalization can only happen based on a rulebase.
-
undefinedpropertyerror <on/off>
Default: off
With this parameter an error message is controlled, which will be put out every time pmnormalize can’t normalize a message.
See Also¶
Caveats/Known Bugs¶
None known at this time.
Example¶
Sample 1:
In this sample messages are received via imtcp. Then they are normalized with the given rulebase and written to a file.
module(load="imtcp")
module(load="pmnormalize")
input(type="imtcp" port="13514" ruleset="ruleset")
parser(name="custom.pmnormalize" type="pmnormalize" rulebase="/tmp/rules.rulebase")
ruleset(name="ruleset" parser="custom.pmnormalize") {
action(type="omfile" file="/tmp/output")
}
Sample 2:
In this sample messages are received via imtcp. Then they are normalized with the given rule array. After that they are written in a file.
module(load="imtcp")
module(load="pmnormalize")
input(type="imtcp" port="10514" ruleset="outp")
parser(name="custom.pmnormalize" type="pmnormalize" rule=[
"rule=:<%pri:number%> %fromhost-ip:ipv4% %hostname:word% %syslogtag:char-to:\\x3a%: %msg:rest%",
"rule=:<%pri:number%> %hostname:word% %fromhost-ip:ipv4% %syslogtag:char-to:\\x3a%: %msg:rest%"])
ruleset(name="outp" parser="custom.pmnormalize") {
action(type="omfile" File="/tmp/output")
}