is there a way to filter/reformat input (e.g. syslog) with multiline messages as if they were single lines?
for example, IEC205I has variable length messages (I have some ones with two and others with a set of 5 lines); is there a way to interpret the "continuation code" ("126" and "791" in the example) that is added at the end of the first line and on the beginning of the others?
I found ways to manage multiline messages if they have a fixed number of lines of if the lines are grouped by an header and a trailer but still nothing in this case.
Thanks a lot!
Follows an example of my input:
674 00000090 DSN=IBN0P.GCCF0001.STORICO.DN.G1695V00,VOLS=123731,TOTALBLOCKS=1768
J0014668 00000290 -S010 P001 00 384 59 .10 .00 .1
128882 WBATCH 0 0 0 0
J0230314 00000090 IEC205I OUT3,FC165104,S011,FILESEQ=1, COMPLETE VOLUME LIST, 126
126 00000090 DSN=TMP.T3592.CRY.PR13.DS,VOLS=600919,
126 00000090 LISTED VOL(S) HAVE BEEN DATA ENCRYPTED,KL1CD:L,KL2CD:L,
126 00000090 KL1=MY.TKLM.TAPES,KL2=MY.TKLM.TAPES,
126 00000090 TOTALBLOCKS=1 *HAS
J0230445 00000090 IEC205I SYSCPY1,NSEJBK99,P010,FILESEQ=7, COMPLETE VOLUME LIST, 791
791 00000090 DSN=D2SBKP0P.BNSE0.USFFPR.D130107.RF38WG.DN,VOLS=127050,
791 00000090 TOTALBLOCKS=356 *H
J0014673 00000281 IEF404I GCCJ0101 - ENDED - TIME=06.15.23
J0014673 00000290 -GCCJ0101 ENDED. NAME-GEST.I-O TOTAL TCB CPU TIME=
.00 TOTAL ELAPSED TIME= .0
ps I just tried with "IFTHEN=(WHEN=GROUP ... RECORDS=5", then RESIZE ICETOOL command, as in "Create large records from small records" from "Smart DFSORT Tricks", but this is not the correct solution in my case. It may works, as I tested, but it is not the solution for this type of messages.