If I have a SEDCMD that is removing data, can I get the length of data removed, eg:
### RAW EVENT
12:01:01 Recieved message : "The Quick Brown Fox Jumps Over The Lazy Dog"
### props.conf
[messages]
SEDCMD-censor = s/message : "[^"]+"/message : "XXX"/
### transformed event
12:01:01 Recieved message : "XXX"
### desired transformed event
12:01:01 Recieved message of length 44
Is this possible with SEDCMD or with a transform?
No, you cannot. You'd need a scripted input to be able to achieve something like that.
No, you cannot. You'd need a scripted input to be able to achieve something like that.