Since I would like to transform it into something more suitable for analysis I was wondering if it follows an established standard (I do not recognize it). It would make it easier to parse it than to jump into regex to cur it apart.
that’s a state change, and that is standard. While you may not see it, everything from the first < to the last > is a dictionary. Thats going to have a bunch of key value pairs, some values may be a dictionary (denoted with a starting < and ending > as well. You’ll most likely have to use regex to parse that, unless you don’t care about the state changes.
Yeah, i’m not sure why it is that way. My guess is so that it’s less code like for people who don’t code. Or it’s a simple interpreter print statement which is converting everything.
I know I’m late to the discussion …
Have you looked at rsyslog modules that store the logs in different entities? e.g. ELK stacks, databases …
I’ve never done this for HA. There is plenty of documentation on the internet.
It’s kind of pointless because you can access the state changes through normal events. What’s in the log is just… well a log. No need to parse the file when you can just build an event trigger.