How to change sending messages with Rsyslog?

Michal Turek

8/1/23, 12:46 PM

i have following rsyslog messages which are going to rsyslog server and i would like to make hidden numbers eg from sip:023401412590 to sip:xxxxxxxxxxxx

does someone have a hint how to do following?

before

<16:11:24.332 **ERR** CAL 18507:18896 0:0> adsf from:<sip:[email protected]>;tag=XZD161HN0HZSm, to:<sip:[email protected]>;tag=asdf, warning:, contact:unknown

i want

<16:11:24.332 **ERR** CAL 18507:18896 0:0> adsf from:<sip:[email protected]>;tag=XZD161HN0HZSm, to:<sip:[email protected]>;tag=asdf, warning:, contact:unknown

numbers are there at least 2x times on different position a just some messages

thinking of something like that (based on How to edit sending messages with Rsyslog?)

$template deleteNumberTo,%msg:R,ERE,1:(.*) to:<sip:[0-9]* --end% to:<sip:xxxxxxxxxxxx %msg:R,ERE,1: to:<sip:[0-9]* (.*)--end%\n"
$template deleteNumberFrom,%msg:R,ERE,1:(.*) from:<sip:[0-9]* --end% from:<sip:xxxxxxxxxxxx %msg:R,ERE,1: from:<sip:[0-9]* (.*)--end%\n"


Module(load="imfile" PollingInterval="2")

Input(type="imfile"
File="/data/data.log"
Tag="ims:"
Severity="info"
Facility="user"
Template="deleteNumberTo"
Template="deleteNumberFrom"
)

thank you a lot for advices in advence michal

0 + 0

rsyslog