Tag: normalizer

  • Available options for normalizer

    -r = path to the rulebase

    -o = output format (Encoder) (just in V 0.1.0)

    -e = output format (Encoder) (since V 0.2.0) !!!

    -E = here you insert the fields that should be dispended (-E “host tag” -> that only dispend the host and the tag field) by default all fields will be dispended

    -p = just the parsed messages will be dispensed (since V 0.2.0)

    -v = debug outout (-v is the normal debug mode; -vv is an expanded debug mode with more information)

    -d = dot file (Is used for creating a graph of the rulebase)