Processing incorrectly formatted syslog messages #3797
Unanswered
1kUHuiswkvj7spRO
asked this question in
Q&A
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
-
Hello all,
I have an appliance that sends logs through the syslog protocol. For some reason, it does not follow any standards in regards to the message formatting. Now I understand that you can specify a regular expression to apply to the message, and declare attributes and records for fluentd to use. I'm doing this currently with another appliance that does not follow RFC standards, which is currently working. The problem I am having is fluentd rejecting the parsing of the data. I've tested my regex against an online validator located here: http://fluentular.herokuapp.com/ and everything checks out. I know the format declaration is deprecated. Could it be failing to parse the message data from lack of a timestamp? I'm not sure what else I'm missing.
Example of raw message, along with error message from fluentd:
Configuration:
Beta Was this translation helpful? Give feedback.
All reactions