Look at this: 2187.133536831:7f3162f15700: Called LogError, msg: module name 'mmjsonparse' is unknown 2187.133936647:7f3162f15700: Called LogError, msg: errors occured in file '/etc/rsyslog.conf' around line 2
I need to check why this happens, but that's the culprit. Maybe using old style for mmjsonparse call settles the issue. Rainer > -----Original Message----- > From: [email protected] [mailto:rsyslog- > [email protected]] On Behalf Of Brian Knox > Sent: Wednesday, June 13, 2012 5:48 PM > To: rsyslog-users > Subject: Re: [rsyslog] rule blocks and mmjsonparse > > Rainer - > > I've attached an rsyslog.conf and two debug logs. I alternatively > commented out one of the two outputs - so the "old_style..." log is using > the old *.* :mmjsonparse: style conf, and the "new_style..." debug log is > using the new config 6 format that's in the conf. > > Let me know if there's any other info I can provide! > Brian > > > > On Wed, Jun 13, 2012 at 10:53 AM, Rainer Gerhards > <[email protected]>wrote: > > > Ok, need to look into it - but some other things in front oft he queue :-( > > > > Could you get me a debug log? Maybe a quick glance at it could enlighten > > me ;) > > > > Rainer > > > > > -----Original Message----- > > > From: [email protected] [mailto:rsyslog- > > > [email protected]] On Behalf Of Brian Knox > > > Sent: Wednesday, June 13, 2012 4:16 PM > > > To: rsyslog-users > > > Subject: Re: [rsyslog] rule blocks and mmjsonparse > > > > > > I believe the template is being taken... earlier I did a test template > > that > > > was "alljson: %!all-json%\n" and I would get lines in the log that were: > > > > > > alljson: > > > alljson: > > > alljson: > > > > > > I tried using a couple of specific properties from the json as well and > > > that didn't work. Trying now with the mixed config as below, and a > > slight > > > changed template I get: > > > > > > some json should be here: > > > some json should be here: > > > some json should be here: > > > some json should be here: > > > some json should be here: > > > some json should be here: > > > some json should be here: > > > some json should be here: > > > some json should be here: > > > some json should be here: > > > some json should be here: > > > some json should be here: > > > some json should be here: > > > some json should be here: > > > > > > but using the style of > > > > > > *.* :mmjsonparse: > > > *.* /path/to/my/file;template > > > > > > with the same template I get: > > > > > > some json should be here: {"name": "imuxsock", "submitted": "0", > > > "ratelimit.discarded": "0", "ratelimit.numratelimiters": "0"} > > > some json should be here: {"name": "pstats_file", "processed": "112", > > > "failed": "0"} > > > some json should be here: {"name": "action 2", "processed": "112", > > > "failed": "0"} > > > some json should be here: {"name": "action 3", "processed": "127", > > > "failed": "0"} > > > some json should be here: {"name": "action 4", "processed": "127", > > > "failed": "0"} > > > some json should be here: {"name": "authpriv_action", "processed": "0", > > > "failed": "0"} > > > some json should be here: {"name": "mail_action", "processed": "0", > > > "failed": "0"} > > > some json should be here: {"name": "cron_action", "processed": "0", > > > "failed": "0"} > > > some json should be here: {"name": "info_action", "processed": "1", > > > "failed": "0"} > > > some json should be here: {"name": "emerg_action", "processed": "0", > > > "failed": "0"} > > > some json should be here: {"name": "local7_action", "processed": "0", > > > "failed": "0"} > > > some json should be here: {"name": "file_log_all", "processed": "127", > > > "failed": "0"} > > > some json should be here: {"name": "mongo_log_all", "processed": "127", > > > "failed": "127"} > > > some json should be here: {"name": "main Q", "size": "13", "enqueued": > > > "140", "full": "0", "discarded.full": "0", "discarded.nf": "0", > > "maxqsize": > > > "15"} > > > > > > So it looks like for some reason, with the new style config block, that > > > either the json derived properties are not getting set, or are somehow > > > going out of scope before the action? > > > > > > Brian > > > > > > > > > > > > > > > On Wed, Jun 13, 2012 at 10:08 AM, Rainer Gerhards > > > <[email protected]>wrote: > > > > > > > Maybe the problem is that the template is not properly taken. Try this: > > > > > > > > if ($programname == 'rsyslogd-pstats') then { > > > > action(name="parse" type="mmjsonparse") > > > > /data/rsyslog/logs/json_parse.log;parse_test > > > > } > > > > > > > > (yes, you can mix&match old and new style ... not that I recommend > > this, > > > > it's a side-effect of the need to support old style at all). > > > > > > > > Rainer > > > > > > > > > -----Original Message----- > > > > > From: [email protected] [mailto:rsyslog- > > > > > [email protected]] On Behalf Of Brian Knox > > > > > Sent: Wednesday, June 13, 2012 4:06 PM > > > > > To: rsyslog-users > > > > > Subject: Re: [rsyslog] rule blocks and mmjsonparse > > > > > > > > > > Some more information.... > > > > > > > > > > $template parse_test,"%$!all-json%\n" > > > > > > > > > > if ($programname == 'rsyslogd-pstats') then { > > > > > action(name="parse" type="mmjsonparse") > > > > > action(name="pstats_file" type="omfile" > > > > > file="/data/rsyslog/logs/pstats_json.log" template="parse_test") > > > > > } > > > > > > > > > > *.* :mmjsonparse: > > > > > *.* /data/rsyslog/logs/json_parse.log;parse_test > > > > > > > > > > Given the above, json_parse.log contains empty lines, while > > > > json_parse.log > > > > > is correct. > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > On Tue, Jun 12, 2012 at 4:44 PM, Brian Knox <[email protected]> > > wrote: > > > > > > > > > > > I have a situation on rsyslog 6 (dev branch!) where, using the new > > > > config > > > > > > format, I'd like to run only messages that match a filter condition > > > > through > > > > > > mmjsonparse. First of all, is this possible, and secondly, what > > would > > > > the > > > > > > syntax be? > > > > > > > > > > > > Essentially, in pseudoish code I want: > > > > > > > > > > > > if ($programname == 'rsyslogd-pstats') then { > > > > > > 1. *.* mmjsonparse > > > > > > 2. (send messages to an output using a template) > > > > > > } > > > > > > > > > > > > Is it possible currently to use mmjsonparse against messages that > > only > > > > > > match a filter condition? > > > > > > > > > > > > Brian > > > > > > > > > > > > > > > > > _______________________________________________ > > > > > rsyslog mailing list > > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > > > http://www.rsyslog.com/professional-services/ > > > > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > > > _______________________________________________ > > > > rsyslog mailing list > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > > http://www.rsyslog.com/professional-services/ > > > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > > > > > > _______________________________________________ > > > rsyslog mailing list > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > http://www.rsyslog.com/professional-services/ > > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com/professional-services/ > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards
