Hi, I am working on a patch for omelasticsearch.
I need to add a dynamic id support for bulk mode.
I have a working prototype but I am blocked by a weird problem.
I use the following configuration :
$template TPL-Format,"{\"m\":\"%msg:::json%\",\"h\":\"%HOSTNAME:::json%\"}"
$template TPL-indexName,"log-foo"
$template TPL-documentType,"FOO"
$template TPL-bulkUUID,"%uuid%"
*.* action(type="omelasticsearch" server="192.168.1.100" serverport="9200"
dynsearchindex="on" searchindex="TPL-indexName"
dynsearchtype="off" searchtype="TPL-documentType"
dynbulkid="on" bulkid="TPL-bulkUUID"
bulkmode="on" template="TPL-Format")
Everything works fine.
However if I activate dynsearchtype (dynsearchtype="on") I get a
"Called LogError, msg: error during parsing file rsyslog.conf [...]"
without any more details. Using RSYSLOG_DEBUG="LogFuncFlow" does not
give any interesting details either here.
In omelasticsearch.c, the code which handles dynsearch* params calls
templates in a given order.
So if I follow the logic in BEGINnewActInst I should get
dynsearchindex : 1, dynsearchtype : 2, dynbulkid : 3 but this does not
seem to work.
Is the logic for calling templates different ? Did I overlook something ?
Thanks in advance for your feedback.
Best Regards,
Attached:
- a patched version of omelasticsearch.c
- an example configuration
--
Jérôme
rsyslog.conf.gz
Description: GNU Zip compressed data
omelasticsearch.c.gz
Description: GNU Zip compressed data
_______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
