title: Format rsyslog messages - remove IP of logserver
body: <p>Our Archive-Server is getting Logs send by a few Log-Server - those write their own IP in every message they forward to the Archive-Server. Now I wanted to "cut" their IP-Adress and "src@" from every Logmessage with the rsyslog configuration of my Archive-Server.</p>
  
  <p>Example:</p>
  
  <p>192.168.0.12 is one of my Log-Server | Foo is the "real" Source-IP translated in its DNS-Name</p>
  
  <ul>
  <li><p>wrong [ Aug 23 10:00:01 192.168.0.12 src@Foo logdata logdata ]</p></li>
  <li><p>right [ Aug 23 10:00:01 Foo logdata logdata ]</p></li>
  </ul>
  
  <p>At first I thought I could go with "FIELDS" and whitespace as a delimiter, but I think I would cut the DNS-Name of my real Source-IP as well, when I wanted to remove src@. Would love to go with sed, if that's possible, but I dont know how to implement that within my rsyslog.conf</p>
  
  <pre><code>sed 's/\(192.168.0.12 @src\)//'
  </code></pre>
  
  <p>should work.</p>
  
  <p>_________UPDATE________</p>
  
  <p>There is a promising looking function called "replace" but I can't seem to get it to work at all.</p>
  
  <p><a href="https://www.rsyslog.com/doc/v8-stable/rainerscript/functions.html#replace-str-substr-to-replace-replace-with" rel="nofollow noreferrer">https://www.rsyslog.com/doc/v8-stable/rainerscript/functions.html#replace-str-substr-to-replace-replace-with</a></p>
  
  <pre><code>if ( $fromhost-ip == '192.168.0.12' ) then {
  
     replace($msg, "@src", " ")
     -/var/log/foo.log
     stop
  }
  </code></pre>
  
  <p>Msgs are written withing foo.log - but nothing is replaced</p>