Please forgive this noob, but I'm struggling to apply a template to an input file facility. I'd like to strip the default rsyslog output of timestamp, hostname, and programname and just send the %msg% from my 'client' to my log server. My (legacy) client configuration like so:
$ModLoad imfile.so # Config for app1 $InputFileName /path/to/log $InputFileTag app1-tag $InputFileStateFile app1-state $InputFileSeverity info $InputFileFacility local3 $InputRunFileMonitor #Config for app2 # as above #Appy template when sending to log server $template msgOnlyTemplate,"%msg%\n" if $syslogfacility-text == 'local3' then @<IP>:<PORT>;msgOnlyTemplate & ~ None of my logs are transferred to the log server when using the above configuration. However, when I revert to something a little more simple that doesn't use a template ( local3.* @<IP>:<PORT> ) everything works just fine. I've also tried getting granular in my test, using "if $programname == 'app1-tag'", and again, all remote logging stops. Switchging back to local3.* witout a template then works just fine. I've looked through documentation and through this user list, but haven't found a solution. Could someone please tell this noob what he's missing here? Thanks in advance for any help. Client and Server: Version : 5.10.1 Vendor: SUSE LINUX Products GmbH, Nuernberg, Germany Release : 0.7.49 Build Date: Fri 10 May 2013 04:26:44 PM CDT Install Date: Wed 16 Apr 2014 09:54:39 AM CDT Build Host: berry Group : System/Daemons Source RPM: rsyslog-5.10.1-0.7.49.src.rpm Size : 1569555 License: GPL v3 or later -- View this message in context: http://rsyslog-users.1305293.n2.nabble.com/imfile-templates-tp7585270.html Sent from the rsyslog-users mailing list archive at Nabble.com. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
