Thanks for the pointers. I used the debug and found that both programname and APP-NAME did the job.
I also found this thanks to your pointers: http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/Deployment_Guide/ch-Viewing_and_Managing_Log_Files.html That had a useful guide to property based and expression based filters. In the end I went with the following expression based filter: if $programname == 'my_app' then @@logs.loggly.com:[port] On 25 January 2012 09:24, Rainer Gerhards <[email protected]> wrote: > > > > -----Original Message----- > > From: [email protected] [mailto:rsyslog- > > [email protected]] On Behalf Of Peter Gillard-Moss > > Sent: Wednesday, January 25, 2012 10:20 AM > > To: rsyslog-users > > Subject: Re: [rsyslog] Conditional forwarding on imfiles > > > > Thanks for the reply Rainer. > > > > I have searched and searched for this (so perhaps it is a RTFM but I'm > > struggling to find what part). > > > > The nearest thing I could find was this: > > :msg, startswith, "my_app:" @@logs.loggly.com:[port]', > > almost ;) It's not msg but rather syslogtag (or tag, don't know out of my > head). > > Quick way to see what is in message: add > *.* /var/log/debuglog;RSYSLOG_DebugFormat > The file will tell you all properties used and actual content. > > Hth rg > > > > Does this look correct? > > > > On 24 January 2012 17:50, Rainer Gerhards <[email protected]> > > wrote: > > > > > You could check for the tag you have configured; make sure that it is > > > sufficiently unique. > > > > > > rainer > > > > > > > -----Original Message----- > > > > From: [email protected] [mailto:rsyslog- > > > > [email protected]] On Behalf Of Peter Gillard-Moss > > > > Sent: Tuesday, January 24, 2012 6:41 PM > > > > To: [email protected] > > > > Subject: [rsyslog] Conditional forwarding on imfiles > > > > > > > > Hello, > > > > > > > > I am using loggly to forward messages to. I need to send logs from > > > > a custom application which uses a bespoke logging format to a > > > > different location. > > > > > > > > I have an imfile config which looks like this: > > > > > > > > $ModLoad imfile > > > > $InputFileName /opt/myapp/log/my_app.log $InputFileTag myapp: > > > > $InputFileStateFile stat-myapp > > > > $InputFileSeverity info > > > > $InputRunFileMonitor > > > > > > > > $InputFilePollInterval 10 > > > > > > > > *.* @@logs.loggly.com:[port] > > > > > > > > I only want to forward entries from my_app. How would I go about > > > > doing this? > > > > > > > > Thanks in advance. > > > > Peter > > > > _______________________________________________ > > > > rsyslog mailing list > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > > http://www.rsyslog.com/professional-services/ > > > _______________________________________________ > > > rsyslog mailing list > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > http://www.rsyslog.com/professional-services/ > > > > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com/professional-services/ > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/
