How to configure props.conf and transforms.conf on Windows heavy forwarder to remove unwanted characters in rsyslog logs?

[feliz]

Hi there,

We have a Windows Heavy Forwarder which gets Windows logs. We want to send these logs to an external Rsyslog Server, using transforms.conf and props.conf:

transforms.conf

[syslog_routing]
REGEX = .
DEST_KEY = _SYSLOG_ROUTING
FORMAT = rsyslog

props.conf

`[syslog_test]

TRANSFORMS-routing = syslog_routing`

outputs.conf

`[syslog]
defaultGroup = rsyslog

[syslog:rsyslog]
server = rsyslog_server:514
type=tcp
timestampformat = %b %e %H:%M:%S`

On the rsyslog, we get these kind of entries:

Nov 12 15:46:34 192.168.135.10 #011Source Port:#011#0118089#015#015
Nov 12 15:46:34 192.168.135.10 #011Destination Address:#01110.0.0.1#015#015
Nov 12 15:46:34 192.168.135.10 #011Destination Port:#011#01164756#015#015
Nov 12 15:46:34 192.168.135.10 #011Protocol: #011#0116#015#015

So the question is, how to get rid of all the #11 and #15?

Thanks!

[yannK]

If the #11 an d #15 are in your initial raw data, try a sedcmd in the props.

[feliz]

Hey, thanks for your answer.

We tried to add SEDCMD-fix_space = s/#011/ /g, with no success...
We also tried to send with stanza tcpout, both on Heavy Forwarder and Indexer , as

`[tcpout]
defaultGroup=syslog_routing
indexAndForward=true
sendCookedData=false

[tcpout:raw_tcp_receiver]
server=rsyslog_server:514`

with no luck.

Edit: same result with SEDCMD-fix_space = s/\#011/ /g, in case that the # character was not interpreted.