NAME
lognormalizer - test and debug liblognorm rulebases
OPTIONS
-r<rulebase> Rulebase to use. This is required option
- -H
-
print summary line (nbr of msgs Handled)
- -U
-
print number of unparsed messages (only if non-zero)
-e<json|xml|csv|cee-syslog|raw>
-
Change output format. By default, json is used Raw is exactly like the input. It is useful in combination with -p/-P options to extract known good/bad messages
- -E<format>
-
Encoder-specific format (used for CSV, read docs)
- -T
-
Include 'event.tags' in JSON format
-oallowRegex Allow regexp matching (read docs about performance penalty)
- -oaddRule
-
Add a mockup of the matching rule.
-oaddRuleLocation Add location of matching rule to metadata
-oaddExecPath Add exec_path attribute to output
-oaddOriginalMsg Always add original message to output, not just in error case
- -p
-
Print back only if the message has been parsed successfully
- -P
-
Print back only if the message has NOT been parsed successfully
- -L
-
Add source file line number information to unparsed line output
- -t<tag>
-
Print back only messages matching the tag
- -v
-
Print debug. When used 3 times, prints parse DAG
- -V
-
Print version information
- -d
-
Print DOT file to stdout and exit
-d<filename> Save DOT file to the filename
-s<filename> Print parse dag statistics and exit
-S<filename> Print extended parse dag statistics and exit (includes -s)
-x<filename> Print statistics as dot file (called only)