Just got the latest v7 rsyslog (from rsyslog ubuntu reepo) working so
trying to come up with simple config but it's hard to find documentation
and the examples are usually short fragments...
Here's what I have so far:
module(load="mmjsonparse")
module(load="omfwd")
template(
name="text"
type="list"
) {
constant(value="message-text:")
property(name="msg")
constant(value="\n")
}
template(
name="json"
type="list"
) {
constant(value="{\"@message\":\"")
property(name="msg" format="json")
constant(value="\"}\n")
}
local0.* action(type="mmjsonparse")
if $parsesuccess == "OK" then {
action(type="omfile" file="/var/log/erikTest.log" template="json")
action(
type="omfwd"
target="flume.ylmmuy.com"
port="5140"
protocol="tcp"
template="json"
)
} else {
action(type="omfile" file="/var/log/erikTest.log" template="text")
action(
type="omfwd"
target="some.hostname"
port="9999"
protocol="tcp"
template="text"
)
}
Questions:
- any suggestions/improvements? :-)
- property in template - I assume it can be any property (as listed
in old format) but what about the rest, e.g. what formats are available
(besides json)?
- I saw an example Module (path="builtin:omfwd") at
http://www.rsyslog.com/doc/rsyslog_conf_modules.html/omfwd.html but that
doesn't work (error during parsing file /etc/rsyslog.d/51-erik.conf, on
or before line 4: parameter 'path' not known -- typo in config file?),
is this obsolete syntax or... ?
- do I need & ~ for messages to be stopped being processed like I see
in older examples?
- any pointers to more complete new style config syntax? (hope
something exists I just missed it)
thanks!
erik
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
