On Thu, 2013-04-25 at 01:57 -0700, Erik Steffl wrote:
> oh, so thse two are not the same:
>
> local0.* something
> & ~
>
this is a list of two actions tied to one filter
> local0.* something
> stop
this is two actions, one with a filter (local0.*) and the other one
without, so it applies to all messages (implicit *.*)
>
> i.e. stop is not for previous match (local0.*) only?
it's just a statment, so why should it? ;)
>
> > want? If not, you need to include the "stop" at an appropriate place
> > inside one of the then... else ... blocks.
> >
> >>
> >> Does that look right?
> >>
> >> I also saw this style (at
> >> http://www.rsyslog.com/doc/rsyslog_conf_modules.html/multi_ruleset.html):
> >>
> >> if prifilt("mail.*") then {
> >> /var/log/mail10516
> >> stop
> >> }
> >>
> >> Does that mean that instead of local.* I could
> > could: yes
> > should: no - do as you like (actually the optimizer creates the same
> > internal representation out of it).
> >
> > This function makes it easier to include such conditions in more complex
> > boolean expressions.
> >> (should?) do:
> >>
> >> if prifilt("local0.*") then {
> >> action(type="mmjsonparse")
> >> if $parsesuccess == "OK" then {
> >> action(type="omfile" file="/var/log/erikTest.log" template="json")
> >> } else {
> >> action(type="omfile" file="/var/log/erikTest.log" template="text")
> >> }
> >> stop
> >> }
> >>
> > yup - I now also probably see what you inteded with the example above. I
> > guess this is what you meant:
> >
> > local0.* { action(type="mmjsonparse")
> > if $parsesuccess == "OK" then {
> > action(type="omfile" file="/var/log/erikTest.log" template="json")
> > ...
> > } else {
> > action(type="omfile" file="/var/log/erikTest.log" template="text")
> > ...
> > }
> > stop
> > }
>
> I think that's what I meant, but is there any difference in my
> version with prifilt above and your version that uses local0.* {...}?
>
> Is local.* { ... stop } replacement for old style config like this:
>
> local.* something
> & something else
> & and more
ampersand is old-style action list. New style blocks come with {}
> $ ~ (discard message)
>
I assume this should be an ampersand as well.
So this is equivalet to
local.* { something
something else
and more
~
}
which I would suggest to write as
local.* {
something
something else
and more
stop
}
It's just regular nested statements...
Rainer
> ?
>
> thanks!
>
> erik
>
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
> sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T
> LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
