動態rsyslog現在模板

Question

我有一個rsyslog現在配置看起來像這樣：

template(name="extract" type="string" string="%msg:R:/(?:"(level)":")((\\"| 

[^"])*)"/g–end%") 

if $InputFileTag == 'esblog' then { 
    set $!level = exec_template("extract"); 
} else { 
    set $!level = $syslogseverity-text; 
} 

template(name="json_lines" type="list") { 
    constant(value="{") 
     constant(value="\"@timestamp\":\"")  property(name="timereported" dateFormat="rfc3339") 
     constant(value="\",\"host\":\"")  property(name="hostname") 
     constant(value="\",\"json.level\":\"") property(name="$!level" format="json") 
     constant(value="\",\"facility\":\"") property(name="syslogfacility-text") 
     constant(value="\",\"tag\":\"") property(name="syslogtag" format="json") 
     constant(value="\",\"message\":\"") property(name="msg" format="json") 
    constant(value="\"}") 
} 

基本上，如果源標籤esblog，我想用這個正則表達式，從「提取」拉嚴重性出來的日誌消息。否則，我想使用默認嚴重性。然後在json.level標籤內使用該變量，以便在傳出消息上只需要一個模板。但沒有運氣讓這個工作。

用正則表達式示例消息：https://regex101.com/r/lN4tD4/1

錯誤日誌

0341.407068000:main thread : error: can not find regex end in: '(?:"level":")(\"|[^"]*)"–end%' 
0341.407084000:main thread : PROP_INVALID for name '' 
0341.407097000:main thread : Called LogMsg, msg: error during parsing file /etc/rsyslog.conf, on or before line 32: invalid property '' 
0341.407195000:main thread : Called LogMsg, msg: error during parsing file /etc/rsyslog.conf, on or before line 32: error processing template object 
0341.407350000:main thread : Called LogMsg, msg: error during parsing file /etc/rsyslog.conf, on or before line 33: exec_template(): template 'extract' 

Answer 1

正則表達式只是需要改變。

template(name="extract" type="string" string="%msg:R,ERE,2,DFLT:(\"level\":\")(\\\"|[^\"]*)\"--end%") 


if $programname contains "esb-log" then { 
    set $!level = exec_template("extract"); 
} else { 
    set $!level = $syslogseverity-text; 
} 

在線rsyslog現在正則表達式工具：http://www.rsyslog.com/regex/