Why does rsyslog replace tabs with #011?

Question

I am using rsyslog to collect nginx logs. All looks good except the replacing usual tabs with '#011' text.

Example of corrupted output:

217.118.93.88#0111473674833.412#0114418687#011...

How it should look:

217.118.93.88    1473674833.412    4418687    ...

Why it is happens and how to disable such replacing?

Thanks!

Answer 1

Try this (which was an undocumented option as far as I could see and found it by skimming through source code):

global(
  parser.escapecontrolcharactertab="off"
)

There is an issue for this on https://github.com/rsyslog/rsyslog/issues/552.

Answer 2

The "quick dirty" fix is to disable escaping special characters.

Add in rsyslog.conf

$EscapeControlCharactersOnReceive off

Despite it is acceptable solution for my case it could be harmful for more complex situations.