[rsyslog-notify] Forum Thread: Re: Join messages by DeviceReportedTime - (Mode 'reply')

[noreply at adiscon.com]

User: dlang 
Forumlink: http://kb.monitorware.com/viewtopic.php?p=24157#p24157

Message: 
----------
rsyslog does not have an ability to join separate messages together, you
would need to do that before you pass it into rsyslog, or between rsyslog
and your database

joining different messages together is a really hard problem in general.
Keep in mind that the messages may be reorders once they are sent to
rsyslog and it gets even harder.

you really need to figure out a way to combine these before they are sent
to rsyslog in the first place.

Now, if these are two lines of a multiline log entry, there may be a chance
of rsyslog doing it for you (assuming you are writing to a file and rsyslog
is then scraping it)

but other than that, it's pretty messy.

David Lang