I think probably the easiest solution is to include your tag inside the MSG part of the message itself. Let M be the original MSG an T be your desired tag. So you could simply set MSG to "T,M". On the receiver, you can use field-based extraction. I don't have the exact syntax at hand, but it is along the lines of %msg:F,1% for T and %msg,F,2% for M.
Rainer > -----Original Message----- > From: [email protected] [mailto:rsyslog- > [email protected]] On Behalf Of Xavier Fustero > Sent: Tuesday, June 12, 2012 10:12 PM > To: [email protected] > Subject: [rsyslog] Creating dynamic files based on home made TAGS > > Hi, > > I am a bit lost on how could be the best way to implement dynamic files > based on personal TAGS. > > I will try to make it clear. I would like to achieve something like > this: > > /var/log/*my_tag1*/rails.log > /var/log/*my_tag2*/messages > ... > > basically, create dynamic entries depending on my own tags. > > I read the doc ref5424 looking for the all possible tags and I read I > can > use the following: > > *PRI VERSION TIMESTAMP HOSTNAME APP-NAME PROCID MSGID STRUCTURED-DATA > MSG* > > I asked on a previous email something related to this and David > suggested > me two possible solutions. One would be to sacrifice one of those tags > for > the one I want. Let's say I replace HOSTNAME for my_tag1 in my client: > > [client] > > replace > > $template GroupApp,"<%PRI%>1 %TIMESTAMP:::date-rfc3339% > *%HOSTNAME%*%APP-NAME% %PROCID% %MSGID% %STRUCTURED-DATA% %msg%\n" > > for > > $template GroupApp,"<%PRI%>1 %TIMESTAMP:::date-rfc3339% > *my_tag1*%APP-NAME% %PROCID% %MSGID% %STRUCTURED-DATA% %msg%\n" > > then I create dynamic files on the server using %HOSTNAME% which in > fact > contains my_tag1. > > That works but I would like to implement this keeping all standard tags > with its original meaning as we might need them for debugging reasons. > It > is not the case but who knows if we need to add several home made tags > together in future. > > David gave me a second solution. He suggested to use mmnormalize. I > have > installed rsyslog 6.2.1 and start playing a bit with rulebase.rb. > However, > I don't understand how it works. I read the manual > http://www.liblognorm.com/files/manual/index.html but even that, I > don't > know how to make it. > > I don't understand if mmnormalize is used for this. If so, could > someone > help me with the rulebase.rb syntax on how to do this? I just would > like to > keep $template GroupApp as it is + adding my own tags. > > Thanks a log, > Xavi > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards
