I try to split information that come from IIS server with syslog-ng configuration. I create and fill the syslog-ng.conf but my csv parser lost the first column. let see:
source s_network {
udp(ip(0.0.0.0) port(514));
};
template test {
template("test arg1 = $VALUE1 arg2 = $VALUE2 arg3 = $VALUE3\n");
template_escape(yes);
};
destination d_file {
file("/var/log/me.log" template(test));
};
parser testpars {
csv-parser(columns("VALUE1", "VALUE2", "VALUE3")
flags(escape-double-char, strip-whitespace)
delimiters(" ")
quote-pairs('""<>[]'));
};
log {
source(s_network);
parser(testpars);
destination(d_file);
};
I send a test message with netcat using:
nc -w0 -u 127.0.0.1 514 <<< "val1 val2 val3"
the result in /var/log/me.log file is
test arg1 = val2 arg2 = val3 arg3 =
my Linux is REDHAT 6 and my syslog version is 3.4.1. Have you an idea?