NAME

lognormalizer - test and debug liblognorm rulebases

OPTIONS

-r<rulebase> Rulebase to use. This is required option

-H

print summary line (nbr of msgs Handled)

-U

print number of unparsed messages (only if non-zero)

-e<json|xml|csv|cee-syslog|raw>

Change output format. By default, json is used Raw is exactly like the input. It is useful in combination with -p/-P options to extract known good/bad messages

-E<format>

Encoder-specific format (used for CSV, read docs)

-T

Include 'event.tags' in JSON format

-oallowRegex Allow regexp matching (read docs about performance penalty)

-oaddRule

Add a mockup of the matching rule.

-oaddRuleLocation Add location of matching rule to metadata

-oaddExecPath Add exec_path attribute to output

-oaddOriginalMsg Always add original message to output, not just in error case

-p

Print back only if the message has been parsed successfully

-P

Print back only if the message has NOT been parsed successfully

-L

Add source file line number information to unparsed line output

-t<tag>

Print back only messages matching the tag

-v

Print debug. When used 3 times, prints parse DAG

-V

Print version information

-d

Print DOT file to stdout and exit

-d<filename> Save DOT file to the filename

-s<filename> Print parse dag statistics and exit

-S<filename> Print extended parse dag statistics and exit (includes -s)

-x<filename> Print statistics as dot file (called only)