Rainer, it might be a stupid question but I can't see the way to inject my tag in my client template.
I read property replacer a few times but I am still stuck. I tried something like: [client] $template GroupApp,"<%PRI%>1 %TIMESTAMP:::date-rfc3339% %HOSTNAME% %APP-NAME% %PROCID% %MSGID% %STRUCTURED-DATA% %TAG1,msg%\n" but I get an INVALID PROPERTY NAME in the server trying to extract it with %msg:F,1%. Is there an easy way to inject those tags directly in client templates? Thanks a log, Xavi On 13 June 2012 09:12, Rainer Gerhards <[email protected]> wrote: > I think probably the easiest solution is to include your tag inside the > MSG part of the message itself. Let M be the original MSG an T be your > desired tag. So you could simply set MSG to "T,M". On the receiver, you can > use field-based extraction. I don't have the exact syntax at hand, but it > is along the lines of > %msg:F,1% for T and %msg,F,2% for M. > > Rainer > > > -----Original Message----- > > From: [email protected] [mailto:rsyslog- > > [email protected]] On Behalf Of Xavier Fustero > > Sent: Tuesday, June 12, 2012 10:12 PM > > To: [email protected] > > Subject: [rsyslog] Creating dynamic files based on home made TAGS > > > > Hi, > > > > I am a bit lost on how could be the best way to implement dynamic files > > based on personal TAGS. > > > > I will try to make it clear. I would like to achieve something like > > this: > > > > /var/log/*my_tag1*/rails.log > > /var/log/*my_tag2*/messages > > ... > > > > basically, create dynamic entries depending on my own tags. > > > > I read the doc ref5424 looking for the all possible tags and I read I > > can > > use the following: > > > > *PRI VERSION TIMESTAMP HOSTNAME APP-NAME PROCID MSGID STRUCTURED-DATA > > MSG* > > > > I asked on a previous email something related to this and David > > suggested > > me two possible solutions. One would be to sacrifice one of those tags > > for > > the one I want. Let's say I replace HOSTNAME for my_tag1 in my client: > > > > [client] > > > > replace > > > > $template GroupApp,"<%PRI%>1 %TIMESTAMP:::date-rfc3339% > > *%HOSTNAME%*%APP-NAME% %PROCID% %MSGID% %STRUCTURED-DATA% %msg%\n" > > > > for > > > > $template GroupApp,"<%PRI%>1 %TIMESTAMP:::date-rfc3339% > > *my_tag1*%APP-NAME% %PROCID% %MSGID% %STRUCTURED-DATA% %msg%\n" > > > > then I create dynamic files on the server using %HOSTNAME% which in > > fact > > contains my_tag1. > > > > That works but I would like to implement this keeping all standard tags > > with its original meaning as we might need them for debugging reasons. > > It > > is not the case but who knows if we need to add several home made tags > > together in future. > > > > David gave me a second solution. He suggested to use mmnormalize. I > > have > > installed rsyslog 6.2.1 and start playing a bit with rulebase.rb. > > However, > > I don't understand how it works. I read the manual > > http://www.liblognorm.com/files/manual/index.html but even that, I > > don't > > know how to make it. > > > > I don't understand if mmnormalize is used for this. If so, could > > someone > > help me with the rulebase.rb syntax on how to do this? I just would > > like to > > keep $template GroupApp as it is + adding my own tags. > > > > Thanks a log, > > Xavi > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com/professional-services/ > > What's up with rsyslog? Follow https://twitter.com/rgerhards > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards
