【RSYSLOG】The Property Replacer【转】

最近在调整日志平台的日志格式，一下是RSYSLOG的 Property Replacer 说明。鉴于RSYSLOG官网略坑，转发一下，原地址忘记了- - |||

The property replacer is a core component in rsyslogd's output system. A syslog message has a number of well-defined properties (see below). Each of this properties can be accessed and manipulated by the property replacer. With it, it is easy to use only part of a property value or manipulate the value, e.g. by converting all characters to lower case.

Accessing Properties

Syslog message properties are used inside templates. They are accessed by putting them between percent signs. Properties can be modified by the property replacer. The full syntax is as follows:

%propname:fromChar:toChar:options%

Available Properties

propname is the name of the property to access. It is case-insensitive (prior to 3.17.0, they were case-senstive).

Currently supported are:

Properties	For
msg	the MSG part of the message (aka "the message"