framing.delimiter.regex

Uses a regular expression to identify the start of the next message.

This parameter applies to imptcp: Plain TCP Syslog.

Name:

framing.delimiter.regex

Scope:

input

Type:

string

Default:

input=off

Required?:

no

Introduced:

at least 5.x, possibly earlier

Description

Experimental parameter. It is similar to “MultiLine”, but provides greater control of when a log message ends. You can specify a regular expression that characterizes the header to expect at the start of the next message. As such, it indicates the end of the current message. For example, one can use this setting to use an RFC3164 header as frame delimiter:

framing.delimiter.regex="^<[0-9]{1,3}>(Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)"

Note that when oversize messages arrive this mode may have problems finding the proper frame terminator. There are some provisions inside imptcp to make these kinds of problems unlikely, but if the messages are very much over the configured MaxMessageSize, imptcp emits an error messages. Chances are great it will properly recover from such a situation.

Input usage

input(type="imptcp" framing.delimiter.regex="...")

See also

See also imptcp: Plain TCP Syslog.

---

Support: rsyslog Assistant | GitHub Discussions | GitHub Issues: rsyslog source project

Contributing: Source & docs: rsyslog source project

© 2008–2025 Rainer Gerhards and others. Licensed under the Apache License 2.0.