I'm trying to setup the logentries service. If a log entry has a token in it
then I would like to send it to api.logentries.com:10000 and if it does not
then I would like to prepend a hardcoded token to it before sending it
there. How do I setup rsyslog to do this? I have my best guess below, but I
don't think it works.
# If there's a logentries token then send it directly to logentries
:msg, regex,
".*[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12}.*"
@@api.logentries.com:10000
# If there's no token, then add a catch-all token and send to logentries
$template LogentriesFormat,"aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee %HOSTNAME%
%syslogtag%%msg%\n"
:msg, !regex,
".*[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12}.*"
@@api.logentries.com:10000;LogentriesFormat
Thanks,
Ben
--
View this message in context:
http://rsyslog-rsyslog-users.1305293.n2.nabble.com/Alter-some-messages-before-sending-to-remote-server-tp7579420.html
Sent from the rsyslog -- rsyslog-users mailing list archive at Nabble.com.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
