Template (name="h3c" type="string" option. SQL="on" string="insert into SystemEvents (ReceivedAt, Facility, DeviceReportedTime, Priority, FromHost, FromIP, Message, SysLogTag) values (' % timegenerated: : : date - mysql % ', '% syslogfacility %', '% % timereported: : : date - mysql', '% syslogpriority %', '% programname %', '% % FromHost - IP', '% MSG: F, have $%', '% programname %')")

*. * : ommysql: localhost, Syslog, rsyslog, a. 12345. H3c
Recently want to assume that a log server, both for sending a log is as follows:
Jun 1, 2019, 5820, v2 13:29:20 % % 10 shell/6/SHELL_CMD_INPUT: - DevIP=192.168.255.222; More Information. The Input string for the save command is the Enter key.

I want MSG to show only the first semicolon to the end of the content, MSG: F, have more than $this grammar sometimes encounter a semicolon, later will be failure, can't get online grammar specification, can anyone tell me how to write?

CodePudding user response:

MSG: F, which field is have? Used to study