Or you can create a template that has the facility/priority as a variable and
then set that variable in your logic.
David Lang
On Mon, 16 Dec 2013, Radu Gheorghe wrote:
Hi Paul,
I think you can do that by defining two different templates:
http://www.rsyslog.com/doc/rsyslog_conf_templates.html
The pseudo-logic I have in mind is:
if match1 then
send with template1
else if match2
send with template2
And the template could be a standard template (scroll to "Standard Template
for Forwarding to a Remote Host (RFC3164 mode)" in the link above, for
example). Except that, instead of putting a variable property like "pri",
you can have a constant for one template, and a different constant for the
other.
2013/12/16 Paul Seymour <[email protected]>
Hello,
I am using imfile to bring in a logfile and what to filter forward to a
receiver based on regex but with different severities with the facility
being local3.
For example one regex is:-
:msg, regex, "Service .* has started." @@<mysystem>
Which I want as info, whilst the
msg, regex, "Service .* has shutdown." @@<mysystem>
This one I would like to be warning or some such.
Any pointers on this ?
Thanks
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
