Templates only apply to output, not input. But it looks like you are trying to use the template properly
you say that none of these are being transferred properly to the log server. This is probably because the logs you are sending are not formatted properly for the log server to parse them properly. What are you using as the log server?
try looking at your network with tcpdump to see if you are sending them correctly. You could have firewall rules blocking the traffic.
David Lang On Wed, 23 Apr 2014, Brian Huntington wrote:
Please forgive this noob, but I'm struggling to apply a template to an input file facility. I'd like to strip the default rsyslog output of timestamp, hostname, and programname and just send the %msg% from my 'client' to my log server. My (legacy) client configuration like so: $ModLoad imfile.so # Config for app1 $InputFileName /path/to/log $InputFileTag app1-tag $InputFileStateFile app1-state $InputFileSeverity info $InputFileFacility local3 $InputRunFileMonitor #Config for app2 # as above #Appy template when sending to log server $template msgOnlyTemplate,"%msg%\n" if $syslogfacility-text == 'local3' then @<IP>:<PORT>;msgOnlyTemplate & ~ None of my logs are transferred to the log server when using the above configuration. However, when I revert to something a little more simple that doesn't use a template ( local3.* @<IP>:<PORT> ) everything works just fine. I've also tried getting granular in my test, using "if $programname == 'app1-tag'", and again, all remote logging stops. Switchging back to local3.* witout a template then works just fine. I've looked through documentation and through this user list, but haven't found a solution. Could someone please tell this noob what he's missing here? Thanks in advance for any help. Client and Server: Version : 5.10.1 Vendor: SUSE LINUX Products GmbH, Nuernberg, Germany Release : 0.7.49 Build Date: Fri 10 May 2013 04:26:44 PM CDT Install Date: Wed 16 Apr 2014 09:54:39 AM CDT Build Host: berry Group : System/Daemons Source RPM: rsyslog-5.10.1-0.7.49.src.rpm Size : 1569555 License: GPL v3 or later -- View this message in context: http://rsyslog-users.1305293.n2.nabble.com/imfile-templates-tp7585270.html Sent from the rsyslog-users mailing list archive at Nabble.com. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
_______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
