I currently have the following input configuration:


And two global variables:

set $.sourceIP = $fromhost-ip;
set $.sourceTag = $syslogtag

How would I be able to extract the values within $!metadata!filename (which should equal /scp_tmp/ as an example) to assign <source_ip_address> only to $.sourceIP and audit from the name of the log file audit.log to $.sourceTag?

1 Answer 1


rsyslog's scripting language RainerScript has several utility functions. The simplest to apply in this case is probably field, which splits a string into fields separated by some character (given by its ascii code in decimal), or a string. You select which of the resulting split fields you want, starting at 1. Eg:

field("/a/b/c", 47, 2)

gives the result "a" as 2nd field, since the first field is the empty space before the first "/". So you can use

set $.sourceIP = field($!metadata!filename, 47, 3);

Don't forget the ";" which is mandatory. You can use the same function to extract the 4th field, and then split again on the "." character to take the 1st field.

For more complicated extractions, there is re_extract where you can use a POSIX ERE regular expression to match some part of a string, perhaps something like

re_extract("/a/b/c.d.log", "([^/]*).log$",0,1,"failed")

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .