Quantcast
Channel: THWACK: Message List - Kiwi Syslog
Viewing all articles
Browse latest Browse all 2141

Re: Message pre-processing - replace double quotes

$
0
0

This is a very common issue when receiving logs, especially JSON or SNMP traps.

 

Create a script that replaces the double quotes with single quotes. Then it will write the result back to Fields.Rawmessagetext. This would run as an action before your external script action. This could be an action in the same rule or in a rule that fires before the external script rule.

 

you could also write the modified message to a custom variable and pass that to your external script.  I’d suggest using CHR() replacements and not plain text quotes.  Replace double quotes, CHR(34), with single quotes, CHR(39).


Viewing all articles
Browse latest Browse all 2141

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>