1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
|
*****************************************************
Log Message Normalization Parser Module (pmnormalize)
*****************************************************
=========================== ===========================================================================
**Module Name:** **pmnormalize**
**Author:** Pascal Withopf <pascalwithopf1@gmail.com>
**Available since:** 8.27.0
=========================== ===========================================================================
Purpose
=======
This parser normalizes messages with the specified rules and populates the
properties for further use.
Configuration Parameters
========================
.. note::
Parameter names are case-insensitive.
Action Parameters
-----------------
Rulebase
^^^^^^^^
.. csv-table::
:header: "type", "default", "mandatory", "|FmtObsoleteName| directive"
:widths: auto
:class: parameter-table
"word", "none", "no", "none"
Specifies which rulebase file is to use. If there are multiple
pmnormalize instances, each one can use a different file. However, a
single instance can use only a single file. This parameter or **rule**
MUST be given, because normalization can only happen based on a rulebase.
It is recommended that an absolute path name is given. Information on
how to create the rulebase can be found in the `liblognorm
manual <http://www.liblognorm.com/files/manual/index.html>`_.
Rule
^^^^
.. csv-table::
:header: "type", "default", "mandatory", "|FmtObsoleteName| directive"
:widths: auto
:class: parameter-table
"array", "none", "no", "none"
Contains an array of strings which will be put together as the rulebase.
This parameter or **rulebase** MUST be given, because normalization can
only happen based on a rulebase.
UndefinedPropertyError
^^^^^^^^^^^^^^^^^^^^^^
.. csv-table::
:header: "type", "default", "mandatory", "|FmtObsoleteName| directive"
:widths: auto
:class: parameter-table
"binary", "off", "no", "none"
With this parameter an error message is controlled, which will be put out
every time pmnormalize can't normalize a message.
Examples
========
Normalize msgs received via imtcp
---------------------------------
In this sample messages are received via imtcp. Then they are normalized with
the given rulebase and written to a file.
.. code-block:: none
module(load="imtcp")
module(load="pmnormalize")
input(type="imtcp" port="13514" ruleset="ruleset")
parser(name="custom.pmnormalize" type="pmnormalize" rulebase="/tmp/rules.rulebase")
ruleset(name="ruleset" parser="custom.pmnormalize") {
action(type="omfile" file="/tmp/output")
}
Write normalized messages to file
---------------------------------
In this sample messages are received via imtcp. Then they are normalized with
the given rule array. After that they are written in a file.
.. code-block:: none
module(load="imtcp")
module(load="pmnormalize")
input(type="imtcp" port="10514" ruleset="outp")
parser(name="custom.pmnormalize" type="pmnormalize" rule=[
"rule=:<%pri:number%> %fromhost-ip:ipv4% %hostname:word% %syslogtag:char-to:\\x3a%: %msg:rest%",
"rule=:<%pri:number%> %hostname:word% %fromhost-ip:ipv4% %syslogtag:char-to:\\x3a%: %msg:rest%"])
ruleset(name="outp" parser="custom.pmnormalize") {
action(type="omfile" File="/tmp/output")
}
|
