0

I am using rsyslog, I have my devices send custom logs to rsyslog encoded in avro. When i receive this log in rsyslog via udp port, I am able t decode. But when it get stored in rsyslog and I try to parse the file and decode the log it fails. Some encoding the rsyslog is doing and lot of # being introduced when stored in file by rsyslog. Can anybody guide me how can i instruct rsyslog not to add any encoding and store this binary data as is? or any decoding level changes i can try out?

sample rsyslog looks like below

Apr 20 13:57:27 10.64.41.10 #000#000#000#000#010????\H4258f87a-7ffe-11ea-8dcf-9a2557ed7397P332B076268B04DE65C3479662A6A8DEB978D27ED#032vip-1_80_http#000P332B076268B04DE65C3479662A6A8DEB978D27ED#006slb#026200.11.10.2#016sg-testHa1536532-7ffd-11ea-a9c6-f673c1138ce6#016http1.1#006GET#002/#026200.11.10.6#000??#006?#003?#001?#003#000#000#000#000#000#000#026200.11.10.2#000#026curl/7.29.0#000#03010.64.42.101#000?#001#001#000#002#002#002#002#002#002#002#002#002#002#000#000#016Unknown#004--#004--#000#000#000#02610.64.41.10#000??#004#000#000 #000#000#000#000
Yogesh BG
  • 1

1 Answers1

0

You should look at this global config option, and perhaps turn it off:

$EscapeControlCharactersOnReceive off
meuh
  • 1,563
  • 10
  • 11