For rsyslog mailing list

Hello rsyslog mailing list :-)

The requirement is to re-format messages, replacing the FQDN with its first two elements (we have rsyslog clients with non-unique bare hostnames).

The clients are configured with "$PreserveFQDN on" so messages are received with FQDNs.

Here's what I tried.  Sorry about any line breaks; the string= is on a single line as is the action(..)

template(name="MyMsgFormat" type="string"
    string="%TIMESTAMP:::date-rfc3339% %HOSTNAME:R:^[^.]*\.[^.]*:% %syslogtag%%msg:::sp-if-no-1st-sp%%msg:::drop-last-lf%\n"
    )
ruleset(name="imudp"){
    action(type="omfile" dynaFile="PerHostPerDay" template="MyMsgFormat")
}
input(type="imudp" port="514" ruleset="imudp")

That resulted in error messages in the debug output:

Reading a token: 2722.117089031:main thread    : Called LogMsg, msg: error during parsing file /etc/rsyslog.conf, on or before line 63: invalid character '"' in object definition - is there an invalid escape sequence somewhere?
rsyslogd: error during parsing file /etc/rsyslog.conf, on or before line 63: invalid character '"' in object definition - is there an invalid escape sequence somewhere? [v8.16.0 try http://www.rsyslog.com/e/2207 ]
2722.117139352:main thread    : Called LogMsg, msg: error during parsing file /etc/rsyslog.conf, on or before line 63: invalid character '%' in object definition - is there an invalid escape sequence somewhere?
rsyslogd: error during parsing file /etc/rsyslog.conf, on or before line 63: invalid character '%' in object definition - is there an invalid escape sequence somewhere? [v8.16.0 try http://www.rsyslog.com/e/2207 ]
Next token is token NAME ()
2722.117155913:main thread    : Called LogMsg, msg: error during parsing file /etc/rsyslog.conf, on or before line 63: syntax error on token 'TIMESTAMP'
rsyslogd: error during parsing file /etc/rsyslog.conf, on or before line 63: syntax error on token 'TIMESTAMP' [v8.16.0 try http://www.rsyslog.com/e/2207 ]
Error: popping token '=' ()

I was not enlightened by http://www.rsyslog.com/e/2207

So I tried escaping the backslash: %HOSTNAME:R:^[^.]*\\.[^.]*:%

That resulted in different error messages in the debug output:

1264.332444913:main thread    : ruleset 'imudp' before optimization:
1264.332452525:main thread    : ruleset 0x7fb8bc7a7c40: rsyslog ruleset imudp:
1264.332497162:main thread    : NOP
1264.332504396:main thread    : ruleset 0x7fb8bc7a7c40: ruleset imudp assigned parser list:
1264.332511511:main thread    : optimizer error: we see a NOP, how come?
1264.332518265:main thread    : ruleset 'imudp' after optimization:
1264.332524963:main thread    : ruleset 0x7fb8bc7a7c40: rsyslog ruleset imudp:
1264.332570840:main thread    : NOP
1264.332578172:main thread    : ruleset 0x7fb8bc7a7c40: ruleset imudp assigned parser list:
1264.332585253:main thread    : ruleset optimization phase finished

The framework is OK because %HOSTNAME:1:5:% does change messages' FQDNs to their first 5 characters.

What to do?

Best

Charles