I guess I'm making it harder then what it needs to be.... I'm building my directory structure (dynamically) based on the syslog information being received and not too sure how to include the %msg% into the template:
$template RemoteHost,"/var/log/rsyslog/ELI/%PROCID%/%SYSLOGTAG:R,ERE,1,DFLT:\[[^]]+\]\[([^]]+)\]\[[^]]+\]--end%/%HOSTNAME%/eli-%$YEAR%%$MONTH%%$DAY%%$HOUR%.log" How do configure %msg% in the template I created above? I'm probably missing something obvious or there additional configuration required. Thanks! -----Original Message----- From: [email protected] [mailto:[email protected]] On Behalf Of Rainer Gerhards Sent: Friday, March 09, 2012 12:22 AM To: rsyslog-users Subject: Re: [rsyslog] rsyslog | how to remove syslog header.... Try $template msgonly,"%msg%\n" *.* /path/to/testfile;msgonly If it works depends on what you actually mean with "just the message". rainer > -----Original Message----- > From: [email protected] [mailto:rsyslog- > [email protected]] On Behalf Of Martinez, Carlos R > Sent: Friday, March 09, 2012 2:07 AM > To: [email protected] > Subject: [rsyslog] rsyslog | how to remove syslog header.... > > I'm a very new rsyslog server user and I'm looking for a way to strip > the header information of incoming syslog messages and only log just > the message. > > It looks like I'll have to create a template of some sort. > > Thanks in advance! > > > Carlos R. Martinez > Charles Schwab & Co., Inc. > Technology Infrastructure Services > Distributed Services - Distributed Business Integration > > onsite: 602.977.8572 > email: > [email protected]<mailto:[email protected]> > > Charles Schwab | T E C H N O L O G Y I N N O V A T I O N > WARNING: All email sent to or from the Charles Schwab corporate email > system is subject to archiving, monitoring and/or review by Schwab > personnel. > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/
