How can I drop part of a syslog header?
my raw event looks like this α _raw: `*Mar 31 09:21:11 10.x.x.x* time=1680239950|hostname=D-xxxx|product=test`
I want to drop only the syslog header part (shown in Bold above) I am trying to use parse with extract and serialize. I also tried with parse (reserialize) but the full event length is going high, I need to drop header and reduce the size of full event as well... how can I do this?
Best Answer
-
You just need Mask with a proper regex
0
Answers
-
You just need Mask with a proper regex
0 -
Have you tried the free Cribl Sandbox yet? All your questions will be answered there!
0 -
Thanks for the tip. Mask with regex helps a bit in reduction to good extent compare to parser and then serialize.
0 -
It just depends, using the Serialize Type you can serialize to KV, CSV, etc., and get great reductions. As long as you are happy with the outcome then that's all that matters.
0 -
Or a simpler Mask
1 -
thank you so much.
0 -
Or an Eval:
1 -
So many ways to do things in Cribl
0 -
here is mine, long regex but works.
1 -
i have made a pipeline for checkpoint log exporter which does 25% reduction using masking and aggregation. You can find it in this Checkpoint Pack:
1
