Excellent, great to hear it is working now :) Rainer
> -----Original Message----- > From: [email protected] [mailto:rsyslog- > [email protected]] On Behalf Of Damjan Žiberna > Sent: Thursday, July 29, 2010 1:24 PM > To: rsyslog-users > Subject: Re: [rsyslog] OmoracleStatement format > > > > > I think it would be best to split the RFC3339 date via the property > > replacer > > (using start and end position) and then feed this to omoracle. > > > > The full doc on property replacer is here: > > > > http://www.rsyslog.com/doc/property_replacer.html > > > I first thought I could replace some strings with regex, but I've got a > fix > from coworker to solve the issue like this: > > $template OmoracleStatement,"INSERT INTO > SYSLOG(hostname,ts,hostip,facility,severity,program,message) VALUES > (:hostname,to_timestamp_tz(:dategen || ' ' || :timegen, 'YYYY-MM-DD > HH24:MI:SS.FF6TZH:TZM'),:hostip,:facility,:severity,:program,:message)" > > $template > TestStmt,"%hostname%%timereported:0:10:date- > rfc3339%%timereported:12:32:date-rfc3339%%fromhost- > ip%%syslogfacility%%syslogseverity%%programname%%msg%" > > It works great now. > > > > > > > > 2. hostname doesn't get written - I only get 127.0.0.1 > > > > It would be useful to write a quick debug file > > > > *.* /var/log/debug.log;RSYSLOG_DebugFormat > > > > This shows what exactly is stored in which property and can probably > used > > to > > solve the question what exactly happens. > > > > It seems that the issue with timestamp was the cause of all the > problems. > The data got displaced for one colon. Not it works like a charm. > > Thanks for the help. > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
