Shorten substring of a field
#1
Malauran
Hello,
I am trying to shorten a part of my raw_field which is way too long : Host_Application="..." to only keep like 50 characters. And I noticed that NXlog is using PCRE syntax for finding a string in a field, but not for the substitution where it uses classic regex.
I tried different things:
- Substitute with a regex the part I want but I can't, since it replaces everything I write in the regex.
- Find the exact string I want to replace with my PCRE rexgex, and then try to substitute it but I can't use the $1 field as the source string to modify.
I would like to know if there is any way of doing what I want.
Malauran
#1
Malauran
Hello,
I am trying to shorten a part of my raw_field which is way too long : Host_Application="..." to only keep like 50 characters.
And I noticed that NXlog is using PCRE syntax for finding a string in a field, but not for the substitution where it uses classic regex.
I tried different things:
Substitute with a regex the part I want but I can't, since it replaces everything I write in the regex.
Find the exact string I want to replace with my PCRE rexgex, and then try to substitute it but I can't use the $1 field as the source string to modify.
I would like to know if there is any way of doing what I want.
Malauran
Hello Sir,
Did you tested something like this?
Exec $Hostname = hostname();
Exec $Hostname = $Hostname+"-security";
In your case you can create a new variable by regex and concatenate them together to generate the required output.
Please let me know if this what you are looking for, if further help needed please share the config and a hostname machine you have.
Sincerely Klevin
