Oh yes it is. The rules syntax is nice and is a big improvement over regexps
that are popular with almost every other log parser out there, but the best
thing is that if your rules fail, liblognorm reports precisely what part of
the log could not be consumed, not just the fact that none of the rules
matched.
Liblognorm has only one major user: rsyslog, for which it was written, but at
some point I thought that it would be nice to have a separate daemon that only
parses logs, so I wrote logdevourer (https://github.com/korbank/logdevourer).
Liblognorm has only one major user: rsyslog, for which it was written, but at some point I thought that it would be nice to have a separate daemon that only parses logs, so I wrote logdevourer (https://github.com/korbank/logdevourer).