Formatting a line output in a file

Tags: format log

#1 JM_782883

Hello In the end I have to come to you because I can't find the way to do it and I'm going a bit crazy.

I have a record entry from a file. This file sends the data in a disorderly way and I have managed to assign it to variables.

Now the only thing I want is to create an output in a file but with the order I need.

EJ of log entry :

user1 2020 barcelona 12 13:39 12 spaghetti

And I want an exit like

Place: <variable of place> , Date: <variable of date> , Age :<variable of age> To generate a line like this : Place : barcelona , Date : 2020 , Age : 12 ....

This is my config.

<Input LOG_IN> Module im_file File "C:\logs\u_ex*" SavePos TRUE <Exec> if $raw_event =~ /(.?)\s"(.?)"\s"(.?)"\s(.?)\s(.?)\s(.?)\s"(.?)"\s"(.?)"\s(.?)\s(.?)\s(.?)\s"(.?)"\s"(.?)"\s(.?)\s(.?)\s"(.?)"/; { $a = $1; $b = $2; $c = $3; $d = $4; $e = $5; $f = $6; $g = $7; $h = $8; $i = $9; $j = $10; $k = $11; $l = $12; $m = $13; $n = $14; $o = $15; $p = $16; } </Exec> </Input>

<Output file> Module om_file File "C:\logs\output.log" </Output>

#2 konstantinosDeactivated Nxlog ✓
#1 JM_782883
Hello In the end I have to come to you because I can't find the way to do it and I'm going a bit crazy. I have a record entry from a file. This file sends the data in a disorderly way and I have managed to assign it to variables. Now the only thing I want is to create an output in a file but with the order I need. EJ of log entry : user1 2020 barcelona 12 13:39 12 spaghetti And I want an exit like Place: <variable of place> , Date: <variable of date> , Age :<variable of age> To generate a line like this : Place : barcelona , Date : 2020 , Age : 12 .... This is my config. <Input LOG_IN> Module im_file File "C:\logs\u_ex*" SavePos TRUE <Exec> if $raw_event =~ /(.?)\s"(.?)"\s"(.?)"\s(.?)\s(.?)\s(.?)\s"(.?)"\s"(.?)"\s(.?)\s(.?)\s(.?)\s"(.?)"\s"(.?)"\s(.?)\s(.?)\s"(.?)"/; { $a = $1; $b = $2; $c = $3; $d = $4; $e = $5; $f = $6; $g = $7; $h = $8; $i = $9; $j = $10; $k = $11; $l = $12; $m = $13; $n = $14; $o = $15; $p = $16; } </Exec> </Input> <Output file> Module om_file File "C:\logs\output.log" </Output>

Hi

Will your input always be in this order?

Then you just need to restructure your raw_event like so:

    <Exec>
    if $raw_event =~ /(\S+)\s(\S+)\s(\S+)\s(\S+)\s(\S+)\s(\S+)\s(\S+).*/
    {
     $raw_event = "Place :" + $3 + ", Date :" + $2 + ", Age :" + $4; 
    }
    </Exec>

Input: "user1 2020 barcelona 12 13:39 12 spaghetti"

Output: "Place : barcelona , Date : 2020 , Age : 12"

Kind regards,

Konstantinos