0

I try to split information that come from IIS server with syslog-ng configuration. I create and fill the syslog-ng.conf but my csv parser lost the first column. let see:

source s_network {
        udp(ip(0.0.0.0) port(514));
};

template test {
        template("test arg1 = $VALUE1 arg2 = $VALUE2 arg3 = $VALUE3\n");
        template_escape(yes);
};

destination d_file {
            file("/var/log/me.log" template(test));
};

parser testpars {
        csv-parser(columns("VALUE1", "VALUE2", "VALUE3")
        flags(escape-double-char, strip-whitespace)
        delimiters(" ")
        quote-pairs('""<>[]'));
};

log {
    source(s_network);
    parser(testpars);
    destination(d_file);
};

I send a test message with netcat using:

nc  -w0 -u 127.0.0.1 514 <<< "val1 val2 val3"

the result in /var/log/me.log file is

test arg1 = val2 arg2 = val3 arg3 = 

my Linux is REDHAT 6 and my syslog version is 3.4.1. Have you an idea?

3 Answers 3

1

Just faced same thing with file() source. The solution was to add flags(no-parse) to the source parameters. I suppose this will help for network source also.

0

You start an array with 0, not with 1.

1
  • Ok but it's the same result with VALUE0 VALUE1 VALUE2
    – tejerka
    Jun 3, 2013 at 12:02
0

You need to add the "greedy" flag ! Otherwise it does not stick the last field.

Example : csv_parser(columns("COLUMN1", "COLUMN2", "COLUMN3") delimiters(",") flags(greedy));

More details : http://www.balabit.com/sites/default/files/documents/syslog-ng-ose-3.3-guides/en/syslog-ng-ose-v3.3-guide-admin-en/html/reference_parsers_csv.html#example_parser_greedy

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .