Use AWK: { print $1, $2, $3, $4, substr($0, index( $0, ">") } Explanation: AWK will split the line up on white space, so printing $1, $2, $3, $4 will give you "27April2012 10:33:44 172.1.2.2 data" single spaced. The substr expression will return the rest of the input line ($0) unchanged from the right arrow. Martin Rushton HPC System Manager, Weapons Technologies Tel: 01959 514777, Mobile: 07939 219057 email: jmrushton at QinetiQ.com www.QinetiQ.com QinetiQ - Delivering customer-focused solutions Please consider the environment before printing this email. -----Original Message----- From: centos-bounces at centos.org [mailto:centos-bounces at centos.org] On Behalf Of C. L. Martinez Sent: 27 April 2012 11:39 To: CentOS mailing list Subject: [CentOS] OT: Rewrite part of a message with rsyslog Hi all, Sorry for the off-topic, but I have not found how to do this. I have installed a centos6 server to act as a syslog receiver. I need to rewrite all messages that comes from one server. For example a part of the message is: "27April2012 10:33:44 172.1.2.2 data >". Sometimes between 27April2012 and 10:33:44 comes with one white space, sometimes with two, etc. I need to normalize this log to use only one white space between all fileds until ">" character. Somebody knows how can I do this?? _______________________________________________ CentOS mailing list CentOS at centos.org http://lists.centos.org/mailman/listinfo/centos This email and any attachments to it may be confidential and are intended solely for the use of the individual to whom it is addressed. If you are not the intended recipient of this email, you must neither take any action based upon its contents, nor copy or show it to anyone. Please contact the sender if you believe you have received this email in error. QinetiQ may monitor email traffic data and also the content of email for the purposes of security. QinetiQ Limited (Registered in England & Wales: Company Number: 3796233) Registered office: Cody Technology Park, Ively Road, Farnborough, Hampshire, GU14 0LX http://www.qinetiq.com.