Available options for normalizer

-r = path to the rulebase

-o = output format (Encoder) (just in V 0.1.0)

-e = output format (Encoder) (since V 0.2.0) !!!

-E = here you insert the fields that should be dispended (-E “host tag” -> that only dispend the host and the tag field) by default all fields will be dispended

-p = just the parsed messages will be dispensed (since V 0.2.0)

-v = debug outout (-v is the normal debug mode; -vv is an expanded debug mode with more information)

-d = dot file (Is used for creating a graph of the rulebase)

Tags: ,

Comments are closed.