rule

Builds the rulebase from an array of strings.

This parameter applies to Log Message Normalization Module (mmnormalize).

Name:

rule

Scope:

action

Type:

array

Default:

none

Required?:

yes

Introduced:

8.26.0

Description

Added in version 8.26.0.

Contains an array of strings which will be put together as the rulebase. This parameter or ruleBase MUST be given, because normalization can only happen based on a rulebase.

Action usage

action(type="mmnormalize" rule=["rule=:%host:word% %ip:ipv4% user was logged out"])

See also

See also Log Message Normalization Module (mmnormalize).

---

Support: rsyslog Assistant | GitHub Discussions | GitHub Issues: rsyslog source project

Contributing: Source & docs: rsyslog source project

© 2008–2026 Rainer Gerhards and others. Licensed under the Apache License 2.0.