rsyslog and regex file flex connector

Hi

rsyslog logs events from the VPN server to an input file. This file is processed by the arcsight regex file flex connector. The problem is that the events do not come to ArcSight, but if you create a separate file, add the events there manually, then everything works.

We know that not all event structures are accounted for in the connector configuration file and therefore not all data will be received, but nevertheless there should still be those that the connector can handle.

What could be the problem? Incorrect connector or look for the problem elsewhere?

Thanks in advance

Bohdan