1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
|
.. _param-imfile-endmsg-regex:
.. _imfile.parameter.input.endmsg-regex:
.. _imfile.parameter.endmsg-regex:
endmsg.regex
============
.. index::
single: imfile; endmsg.regex
single: endmsg.regex
.. summary-start
Regex that identifies the end of a multi-line message.
.. summary-end
This parameter applies to :doc:`../../configuration/modules/imfile`.
:Name: endmsg.regex
:Scope: input
:Type: string (see :doc:`../../rainerscript/constant_strings`)
:Default: none
:Required?: no
:Introduced: 8.38.0
Description
-----------
Allows processing of multi-line messages. A message is terminated when
``endmsg.regex`` matches the line that marks the end of the message. It is
more flexible than ``readMode`` but has lower performance. ``endmsg.regex``,
``startmsg.regex`` and ``readMode`` cannot all be defined for the same
input.
Examples:
.. code-block:: none
date stdout P start of message
date stdout P middle of message
date stdout F end of message
Here ``endmsg.regex="^[^ ]+ stdout F "`` matches the line with ``F`` and
assembles the message ``start of message middle of message end of message``.
Input usage
-----------
.. _param-imfile-input-endmsg-regex:
.. _imfile.parameter.input.endmsg-regex-usage:
.. code-block:: rsyslog
input(type="imfile"
File="/var/log/example.log"
Tag="example"
endmsg.regex="pattern")
See also
--------
See also :doc:`../../configuration/modules/imfile`.
|
