1
response

Hello
In the end I have to come to you because I can't find the way to do it and I'm going a bit crazy.

I have a record entry from a file. This file sends the data in a disorderly way and I have managed to assign it to variables.

Now the only thing I want is to create an output in a file but with the order I need.

EJ of log entry :

user1 2020 barcelona 12 13:39 12 spaghetti

And I want an exit like

Place: <variable of place> , Date: <variable of date> , Age :<variable of age>
To generate a line like this : Place : barcelona , Date : 2020 , Age : 12 ....

This is my config.

<Input LOG_IN>
Module im_file
File "C:\logs\u_ex*"
SavePos TRUE
<Exec>
if $raw_event =~ /(.*?)\s"(.*?)"\s"(.*?)"\s(.*?)\s(.*?)\s(.*?)\s"(.*?)"\s"(.*?)"\s(.*?)\s(.*?)\s(.*?)\s"(.*?)"\s"(.*?)"\s(.*?)\s(.*?)\s"(.*?)"/;
{
$a = $1;
$b = $2;
$c = $3;
$d = $4;
$e = $5;
$f = $6;
$g = $7;
$h = $8;
$i = $9;
$j = $10;
$k = $11;
$l = $12;
$m = $13;
$n = $14;
$o = $15;
$p = $16;
}
</Exec>
</Input>

<Output file>
Module om_file
File "C:\logs\output.log"
</Output>

AskedOctober 15, 2020 - 1:46pm

Answer (1)

Hi

Will your input always be in this order?

Then you just need to restructure your raw_event like so:

    <Exec>
    if $raw_event =~ /(\S+)\s(\S+)\s(\S+)\s(\S+)\s(\S+)\s(\S+)\s(\S+).*/
    {
     $raw_event = "Place :" + $3 + ", Date :" + $2 + ", Age :" + $4; 
    }
    </Exec>

Input: "user1 2020 barcelona 12 13:39 12 spaghetti"

Output: "Place : barcelona , Date : 2020 , Age : 12"

Kind regards,

Konstantinos