On Tue, 3 Feb 2015, Otis Gospodnetic wrote:
Hi,Over on http://www.rsyslog.com/doc/master/configuration/modules/imfile.html I see a mention of Tag [tag:] like this: Tag [tag:] *(Required Parameter)* The tag to be used for messages that originate from this file. If you would like to see the colon after the tag, you need to specify it here (like ‘tag=”myTagValue:”’). But then further below the example doesn't use that ":". I've noticed that when I *don't* use that ":" my logs (from imfile) are not getting shippet to their destination. As soon as I add ":" they make it to their desitnation. Yet, the above info makes it sound like that ":" is optional. And the example at the bottom of imfile page shows an example without ":", like so: # File 1 input(type="imfile" File="/path/to/file1" Tag="tag1" Severity="error" Facility="local7") I couldn't find any info about: * is this ":" really needed or is it optional? * what is the purpose of ":"? I'd like to tag my logs in Logsene <http://sematext.com/logsene/>, but I'd like to avoid tags with trailing ":", because that ":" conflicts with a typical search syntax, etc.
the tag value goes in the 'syslogtag' field, which is traditionally programname[pid]:
If you put a : on the end of the tag, it follows this convention and anything that gets it is able to properly recognize that that field is the syslogtag. If you use the $programname in rsyslog, you will get the tag without the :
Apparently something in your data flow is being thrown off by the lack of the : and is probably thinking that you have a malformed message that didn't send the hostname and/or the programname and is trying to 'correct' things (to the point where it doesn't match what you are expecting)
The best thing to do is to have the : at the end of the tag, and then use $programname (without the : ) in your searches.
does this help? David Lang
_______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
