topic Re: transforms.conf delimiter ASCII in Getting Data In

transforms.conf delimiter ASCII

pierre_weg — Tue, 12 May 2015 17:46:17 GMT

Hi all!

A have a log file that use ASCII Dec 031 (US - Unit Separator) as delimiter.
How can I configure my transforms and props to work with this delimiter?

Thanks a lot.

Re: transforms.conf delimiter ASCII

woodcock — Tue, 12 May 2015 18:45:12 GMT

Use RegEx encoding for this character: \x1F.

Re: transforms.conf delimiter ASCII

pierre_weg — Mon, 28 Sep 2020 19:57:24 GMT

I set my props as follow:
[mailheader]
NO_BINARY_CHECK = 1
pulldown_type = 1
CHECK_FOR_HEADER = false
REPORT-AutoHeader = MailHeader

and my transforms as follow:
[MailHeader]
DELIMS="\1f"
FIELDS="FILENAME","TIMESTAMP","IP","FROM","RETURN_PATH","TO","CC","SUBJECT","AUTH"

Is not running... 😞
The fields aro not correctly separated.

Re: transforms.conf delimiter ASCII

woodcock — Wed, 13 May 2015 15:17:38 GMT

I am not sure if DELIMS method will work but try this transforms.conf and see:

[MailHeader]
DELIMS="\x1F"
FIELDS=FILENAME, TIMESTAMP, IP, FROM, RETURN_PATH, TO, CC, SUBJECT, AUTH

If you can't make it work then keep your props.conf the same and try this for transforms.conf:

[MailHeader]
REGEX=^([^\x1F]*)\x1F([^\x1F]*)\x1F([^\x1F]*)\x1F([^\x1F]*)\x1F([^\x1F]*)\x1F([^\x1F]*)\x1F([^\x1F]*)\x1F([^\x1F]*)\x1F([^\x1F]*)
FORMAT=FILENAME::$1 TIMESTAMP::$2 IP::$3 FROM::$4 RETURN_PATH::$5 TO::$6 CC::$7 SUBJECT::$8 AUTH::$9

Re: transforms.conf delimiter ASCII

pierre_weg — Wed, 13 May 2015 17:22:50 GMT

Great!
DELIMS do not work, but REGEX works very fine.
Thanks a lot