topic Re: remove prefix on every events using SEDCMD in Getting Data In

remove prefix on every events using SEDCMD

roopeshetty — Thu, 18 Jan 2024 14:01:23 GMT

Hi Guys

We are getting logs through syslog with its priority / facility data “ <14>1” prepended with every events as below;

<14>1 2024-01-18T13:45:06.621+0000 756565656565701b-cd27-475e-bab4-3e0e0893d273

<14>1 2024-01-18T13:39:47.014+0000 565gt5t54t-cd27-475e-bab4-565656565gh

We are trying to remove this prefix texts “<14>1” using SEDCMD on props.conf as below;

[source::tcp:7514]

SEDCMD-strip-tcp-priority=s/^<\d+>//

This is doing almost very close help by removing “<14>” but still “1” is coming up in events. Can some one please help us how to remove this prefix “ <14>1” on every events using SEDCMD ?

Regards.

Re: remove prefix on every events using SEDCMD

ITWhisperer — Thu, 18 Jan 2024 14:05:47 GMT

SEDCMD-strip-tcp-priority=s/^<\d+>\d//

Re: remove prefix on every events using SEDCMD

roopeshetty — Thu, 18 Jan 2024 14:15:31 GMT

Hi ITWhisperer,

Thanks, its almost done, but i see a space (gap) before the timestamp, how can we delete this space?

Re: remove prefix on every events using SEDCMD

PickleRick — Thu, 18 Jan 2024 14:28:35 GMT

If you need to tweak your regexes, that's a great interactive tool to test them.

https://regex101.com/

Re: remove prefix on every events using SEDCMD

ITWhisperer — Thu, 18 Jan 2024 15:22:10 GMT

SEDCMD-strip-tcp-priority=s/^<\d+>\d\s//