[rsyslog-notify] Forum Thread: Problem with field-based extraction - (Mode 'post')

[noreply at adiscon.com]

User: dan0765 
Forumlink: http://kb.monitorware.com/viewtopic.php?p=24454#p24454

Message: 
----------
Hi, am attempting to construct a template that will allow me to extract
fields from a message using the pipe symbol (x7C) as the delimiter. For
example, I believe the following would extract the 10th field:

# Test Template
template(name="test" type="string"
  string="%msg:F,7C:10%\n")

Unfortunately, when I restart rsyslog I keep getting the following error
message:

Mar 30 11:45:23 ssl0014 rsyslogd: [origin software="rsyslogd"
swVersion="7.6.2" x-pid="28063" x-info="http://www.rsyslog.com"] start
Mar 30 11:45:23 ssl0014 rsyslogd-2207: error during parsing file
/etc/rsyslog.conf, on or before line 40: invalid property ' ' [try <!-- m
--><a class="postlink"
href="http://www.rsyslog.com/e/2207">http://www.rsyslog.com/e/2207</a><!--
m --> ]
Mar 30 11:45:23 ssl0014 rsyslogd-2207: error during parsing file
/etc/rsyslog.conf, on or before line 40: error processing template object
[try <!-- m --><a class="postlink"
href="http://www.rsyslog.com/e/2207">http://www.rsyslog.com/e/2207</a><!--
m --> ]

What am I doing wrong? Is this syntax still supported in version 7.6.2? If
not, what is the correct method for doing this kind of field-based
extraction?