After searching about a bit more, it looks like mmnormalize might be what I'm after. Let me know if I'm headed down the wrong path. ________________________________________ From: [email protected] [[email protected]] on behalf of Devin Christensen [[email protected]] Sent: Wednesday, September 10, 2014 3:53 PM To: [email protected] Subject: [rsyslog] Forward One Action to Another
I have a scenario where some logs come into rsyslog as preformatted json that uses a template which removes everything but the %msg%. I have another template setup to format the standard syslog messages I'm interested in as JSON. Currently, I have two actions setup for each template that forward to the same remote server. I would like to use a single action for the transmission to the remote server. Is there a way to apply a template to a message and then forward the result to another action? Perhaps using call ruleset? This email message is for the sole use of the intended recipient(s) and may contain confidential, proprietary and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message. If you are the intended recipient, please be advised that the content of this message is subject to access, review and disclosure by the sender's Email System Administrator. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT. This email message is for the sole use of the intended recipient(s) and may contain confidential, proprietary and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message. If you are the intended recipient, please be advised that the content of this message is subject to access, review and disclosure by the sender's Email System Administrator. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
