On Thu, Sep 11, 2014 at 12:22 AM, David Lang <[email protected]> wrote: > mmnormalize could very well do the job, it is a general purpose parsing > tool. > > but if you are needing to format the message in different ways, but then > send it over one connection (I can see how that could be important to > things like databases, but it's an odd requirement, more detail please), > things get messier. > > side-note: if it really must be a *single* connection, you also must limit the number of worker threads to 1.
Rainer you can't have one action forward to another, but you can have one if > statement define a $!mymessage variable, another if statement define it > based on different logic, and then an action that spits out whatever is in > that variable. > > David Lang > > > On Wed, 10 Sep 2014, Devin Christensen wrote: > > After searching about a bit more, it looks like mmnormalize might be what >> I'm after. Let me know if I'm headed down the wrong path. >> ________________________________________ >> From: [email protected] [rsyslog-bounces@lists. >> adiscon.com] on behalf of Devin Christensen [Devin.Christensen@ >> moneydesktop.com] >> Sent: Wednesday, September 10, 2014 3:53 PM >> To: [email protected] >> Subject: [rsyslog] Forward One Action to Another >> >> I have a scenario where some logs come into rsyslog as preformatted json >> that uses a template which removes everything but the %msg%. I have another >> template setup to format the standard syslog messages I'm interested in as >> JSON. Currently, I have two actions setup for each template that forward to >> the same remote server. I would like to use a single action for the >> transmission to the remote server. Is there a way to apply a template to a >> message and then forward the result to another action? Perhaps using call >> ruleset? >> This email message is for the sole use of the intended recipient(s) and >> may contain confidential, proprietary and privileged information. Any >> unauthorized review, use, disclosure or distribution is prohibited. If you >> are not the intended recipient, please contact the sender by reply email >> and destroy all copies of the original message. If you are the intended >> recipient, please be advised that the content of this message is subject to >> access, review and disclosure by the sender's Email System Administrator. >> > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
