exec "bzcat /var/log/messages.0.bz2" { type "foo" { match = "%SYSLOGBASE%"; key = "x"; reaction = { $d->{"offsets"} = $d->{"offsets"} || {}; my $time = meta2string("%SYSLOGDATE|parsedate%", $v); my $key = $time - ($time % 3600); my $offset = $d->{"curoffset"} || 0; if (!exists($d->{"offsets"}->{$key})) { print meta2string("$time/$key (%SYSLOGDATE%) / Start: $offset\n", $v); $d->{"offsets"}->{$key} = $offset } $d->{"curoffset"} = $offset + length($v->{"=LINE"}); }; }; };