README.md in remote_syslog-1.1.1 vs README.md in remote_syslog-1.2.0

- old
+ new

@@ -88,9 +88,44 @@ destination: host: logs.papertrailapp.com port: 12345 +### Optional: Parse fields from messages written by syslogd + +This is not needed for most configurations. + +In cases where logs from multiple programs are in the same file (for example, +``/var/log/messages``), the log line may include text that is not part of the +log message, like a timestamp, hostname, or program name. remote_syslog can +parse the program, hostname, and/or message text so that the message has +accurate metadata. + +To do that, add an optional top-level configuration option `parse_fields` +with the name of a predefined regex (by remote_syslog) or a regex string. To +use the predefined regex for standard syslog messages, provide: + + parse_fields: syslog + +The `syslog` regex is `(\w+ \d+ \S+) (\S+) ([^:]+): (.*)`. It parses this: + + Jul 18 08:25:08 hostname programname[1234]: The log message + +Or provide your own regex that includes these 4 backreferences, in order: +timestamp, system name, program name, message. Match and return empty +strings for any empty positions where the log value should be ignored. +For example, in the log: + + something-meaningless The log message + +You could ignore the first word, returning 3 empty values then the log +message with: + + parse_fields: "something-meaningless ()()()(.*)" + +Per-file parsing is not supported. Run multiple instances. + + ## Reporting bugs 1. See whether the issue has already been reported: <https://github.com/papertrail/remote_syslog/issues/> 2. If you don't find one, create an issue with a repro case.