LOGNORMALIZER(1)

NAME
lognormalizer - test and debug liblognorm rulebases

OPTIONS

-r<rulebase> Rulebase to use. This is required option

-H  print summary line (nbr of msgs Handled)

-U  print number of unparsed messages (only if non-zero)

-e<json|xml|csv|cee-syslog|raw>

    Change output format. By default, json is used Raw is exactly like the input. It is useful in combination with -p/-P options to extract known good/bad messages

-E<format>
    Encoder-specific format (used for CSV, read docs)

-T  Include 'event.tags' in JSON format

-oallowRegex Allow regexp matching (read docs about performance penalty)

-oaddRule
    Add a mockup of the matching rule.

-oaddRuleLocation Add location of matching rule to metadata

-oaddExecPath Add exec_path attribute to output

-oaddOriginalMsg Always add original message to output, not just in error case

-p  Print back only if the message has been parsed successfully

-P  Print back only if the message has NOT been parsed successfully

-L  Add source file line number information to unparsed line output

-t<tag>
    Print back only messages matching the tag

-v  Print debug. When used 3 times, prints parse DAG

-V  Print version information

-d  Print DOT file to stdout and exit

-d<filename> Save DOT file to the filename

-s<filename> Print parse dag statistics and exit

-S<filename> Print extended parse dag statistics and exit (includes -s)

-x<filename> Print statistics as dot file (called only)