README.md in remote_syslog-1.1.1 vs README.md in remote_syslog-1.2.0
- old
+ new
@@ -88,9 +88,44 @@
destination:
host: logs.papertrailapp.com
port: 12345
+### Optional: Parse fields from messages written by syslogd
+
+This is not needed for most configurations.
+
+In cases where logs from multiple programs are in the same file (for example,
+``/var/log/messages``), the log line may include text that is not part of the
+log message, like a timestamp, hostname, or program name. remote_syslog can
+parse the program, hostname, and/or message text so that the message has
+accurate metadata.
+
+To do that, add an optional top-level configuration option `parse_fields`
+with the name of a predefined regex (by remote_syslog) or a regex string. To
+use the predefined regex for standard syslog messages, provide:
+
+ parse_fields: syslog
+
+The `syslog` regex is `(\w+ \d+ \S+) (\S+) ([^:]+): (.*)`. It parses this:
+
+ Jul 18 08:25:08 hostname programname[1234]: The log message
+
+Or provide your own regex that includes these 4 backreferences, in order:
+timestamp, system name, program name, message. Match and return empty
+strings for any empty positions where the log value should be ignored.
+For example, in the log:
+
+ something-meaningless The log message
+
+You could ignore the first word, returning 3 empty values then the log
+message with:
+
+ parse_fields: "something-meaningless ()()()(.*)"
+
+Per-file parsing is not supported. Run multiple instances.
+
+
## Reporting bugs
1. See whether the issue has already been reported: <https://github.com/papertrail/remote_syslog/issues/>
2. If you don't find one, create an issue with a repro case.