Seems like that $$! copies only a reference and $! copies the whole
variable.
Have you tried to use this instead:
set $!trusted!local!gid = $!gid;
set $!trusted!local!uid = $!uid;
set $!trusted!local!pid = $!pid;
set $!trusted!local!appname = $!appname;
set $!trusted!local!cmd = $!cmd;
best regards,
Andre Lorbach
> -----Original Message-----
> From: David Lang [mailto:[email protected]]
> Sent: Friday, July 26, 2013 3:19 PM
> To: [email protected]; rsyslog-users
> Subject: Re: [rsyslog] problem copying variables and unsetting the
> originals
>
> module(load="imuxsock" SysSock.Annotate="on"
> SysSock.ParseTrusted="on")
> module(load="imklog")
> module(load="imudp")
> input(type="imudp" port="514")
> module(load="imtcp" MaxSessions="1000") input(type="imtcp" port="514")
> module(load="mmjsonparse")
> action(type="mmjsonparse")
> if $fromhost-ip != "127.0.0.1" then {
> #if the log is being received from another machine, add metadata
> to the log
> set $!trusted!origserver = $fromhost-ip;
> set $!trusted!edge!time = $timegenerated;
> set $!trusted!edge!relay = $$myhostname;
> set $!trusted!edge!input = $inputname; } else {
> set $!trusted!local!gid = $$!gid;
> unset $!gid;
> set $!trusted!local!uid = $$!uid;
> unset $!uid;
> set $!trusted!local!pid = $$!pid;
> unset $!pid;
> set $!trusted!local!appname = $$!appname;
> unset $!appname;
> set $!trusted!local!cmd = $$!cmd;
> unset $!cmd;
> set $!trusted!local!input = $inputname; } set
> $!trusted!environment = "sending network"; # this should be replaced
> with a lookup table call when that feature is added.
> $template structured_forwarding,"<%pri%>%timereported% %hostname%
> %syslogtag% %$!%\n"
> /var/log/messages;structured_forwarding
>
> as-is this will show the variables under trusted!local, but with
> values of null, comment out the unset lines and the correct info will
show up in both places.
>
> David Lang
>
> On Fri, 26 Jul 2013, Andre Lorbach wrote:
>
> > Date: Fri, 26 Jul 2013 15:14:13 +0200
> > From: Andre Lorbach <[email protected]>
> > To: rsyslog-users <[email protected]>
> > Subject: Re: [rsyslog] problem copying variables and unsetting the
> > originals
> >
> > Hi David,
> >
> > Could you send me a full working sample config?
> > This would help trying to reproduce the problem.
> >
> > Best regards,
> > Andre
> >
> >> -----Original Message-----
> >> From: [email protected] [mailto:rsyslog-
> >> [email protected]] On Behalf Of David Lang
> >> Sent: Wednesday, July 24, 2013 11:47 PM
> >> To: rsyslog-users
> >> Subject: [rsyslog] problem copying variables and unsetting the
> >> originals
> >>
> >> I'm trying to move variables to a different location in the JSON
> > structure.
> >>
> >> If I do:
> >> set $!trusted!local!gid = $$!gid;
> >> unset $!gid;
> >> set $!trusted!local!uid = $$!uid;
> >> unset $!uid;
> >> set $!trusted!local!pid = $$!pid;
> >> unset $!pid;
> >> set $!trusted!local!appname = $$!appname;
> >> unset $!appname;
> >> set $!trusted!local!cmd = $$!cmd;
> >> unset $!cmd;
> >>
> >> the $!trusted!local!* variables are all defined to be null
> >>
> >> but if I eliminate the unset statements, both the old and the new
> > variables
> >> show up with the correct value.
> >>
> >> This looks like the new variables gets pointed to the old variables
> > instead of
> >> to the contents of the old variables.
> >>
> >> David Lang
> >> _______________________________________________
> >> rsyslog mailing list
> >> http://lists.adiscon.net/mailman/listinfo/rsyslog
> >> http://www.rsyslog.com/professional-services/
> >> What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE
WELL:
> >> This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
> >> sites
> > beyond
> >> our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
> THAT.
> > _______________________________________________
> > rsyslog mailing list
> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > http://www.rsyslog.com/professional-services/
> > What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE
> > WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
> > of sites
> beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T
> LIKE THAT.
> >
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
