I have an rsyslog server running v7.4.3 receiving a stream with the format:
<PRI>Date hostname app: name=VALUE message
What I need to do is pull the VALUE out of the message, and log it in a file such as /var/log/VALUE/syslog.log
I can get "name=VALUE" out of the message using a regular expression but have no idea how to strip out the "name=" or translate that into the path. Any ideas?
Best Answer
So here's how. Note you need to use rsyslog 7.4.5 or higher, as there's a nasty bug in previous versions that causes rsyslog to crash when using re_extract.
And that appears to work.