1 Copper

ASL parsing syslog messages


I'm trying to create an asl rule that checks incoming syslog messages.

What I want to achieve is to have a check for '%' in the message and

cut all characters prior to this one and then continue until eol is reached.

Has anyone a suggestion on how to achieve this?

Labels (1)
Tags (4)
0 Kudos
2 Replies
2 Iron

Re: ASL parsing syslog messages


Here are a few KB's on ASL parsing.

Smarts Syslog Adapter: How do you enable debug logging for the Smarts Syslog adapter?  Another option may be to enable debug logging, which this kb will show.

Ionix/Smarts ASL:  How to I Parse based on delimiters using the Adapter Scripting Language

Smarts ASL: How to test that my Smarts ASL script has the correct syntax?

I'll see if I can find a better example for your question above.


0 Kudos
1 Copper

Re: ASL parsing syslog messages

Thanks Nate,

I managed to resolve this by using the following code;


  input = MESSAGE;

  delim = "%";

  unusedPrefix : word

  slice : rep(word) eol

  } do {

    return slice;


Might not be the preferred way to do it but it works for now.

0 Kudos