Parsing windows log to simplify message text in kiwisyslog

Hi everyone,

I'm tring to find a script (or anything else) to simplify the message in kiwi syslog with no luck.

In kiwi we receive this :


Have i any chance to receive just somethin like that :


Message content would be computer name and juste the content of log (Test Message from Log Forwarder to the 'System' event log.), no the entire line with date, event categorie etc.


Thanks in advance for your help.

Parents
  • You can change the fields displayed in the console.  In the 'View' menu select 'Show/Hide columns', choose Hostname and Message.  This doesn't completely solve your issue...

    To actually change the message and display it you will need to write a small script that splits the message and then saves it. Most messages will have tab separated fields so that would be the place to start.  There is an example script called 'Script_SplitMessageIntoFields' that should get it started. Save the message part you want to the variable 'VarCleanMessageText'.  Make sure the script action is before the Display or Log to file actions.

    The script combined with the console change should then just show the sending hostname and portion of the message you saved.

Reply
  • You can change the fields displayed in the console.  In the 'View' menu select 'Show/Hide columns', choose Hostname and Message.  This doesn't completely solve your issue...

    To actually change the message and display it you will need to write a small script that splits the message and then saves it. Most messages will have tab separated fields so that would be the place to start.  There is an example script called 'Script_SplitMessageIntoFields' that should get it started. Save the message part you want to the variable 'VarCleanMessageText'.  Make sure the script action is before the Display or Log to file actions.

    The script combined with the console change should then just show the sending hostname and portion of the message you saved.

Children
No Data