mmnormalize could very well do the job, it is a general purpose parsing tool.
but if you are needing to format the message in different ways, but then send it over one connection (I can see how that could be important to things like databases, but it's an odd requirement, more detail please), things get messier.
you can't have one action forward to another, but you can have one if statement define a $!mymessage variable, another if statement define it based on different logic, and then an action that spits out whatever is in that variable.
David Lang On Wed, 10 Sep 2014, Devin Christensen wrote:
After searching about a bit more, it looks like mmnormalize might be what I'm after. Let me know if I'm headed down the wrong path. ________________________________________ From: [email protected] [[email protected]] on behalf of Devin Christensen [[email protected]] Sent: Wednesday, September 10, 2014 3:53 PM To: [email protected] Subject: [rsyslog] Forward One Action to Another I have a scenario where some logs come into rsyslog as preformatted json that uses a template which removes everything but the %msg%. I have another template setup to format the standard syslog messages I'm interested in as JSON. Currently, I have two actions setup for each template that forward to the same remote server. I would like to use a single action for the transmission to the remote server. Is there a way to apply a template to a message and then forward the result to another action? Perhaps using call ruleset? This email message is for the sole use of the intended recipient(s) and may contain confidential, proprietary and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message. If you are the intended recipient, please be advised that the content of this message is subject to access, review and disclosure by the sender's Email System Administrator.
_______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
