2015-02-26 23:28 GMT+01:00 David Lang <[email protected]>: > This page gives an example of using a single parser in a ruleset. > http://www.rsyslog.com/doc/v8-stable/configuration/modules/pmciscoios.html > > http://www.rsyslog.com/doc/v8-stable/configuration/parser.html > > a quick search is not finding any examples of how to define a list of > parsers instead of a single one. > > I think this is an array paramter, so you can do ["parser1","parser2",...] instead of "parser".
HTH Rainer > David Lang > > > On Thu, 26 Feb 2015, Kevin Newman wrote: > > Date: Thu, 26 Feb 2015 20:12:10 +0000 >> From: Kevin Newman <[email protected]> >> Reply-To: rsyslog-users <[email protected]> >> To: "[email protected]" <[email protected]> >> Subject: [rsyslog] Binding a Specific Parser to Ruleset - New Config >> Format? >> >> >> Hi, >> >> Within the new configuration format of a RuleSet, what is the syntax of >> binding a specific RuleSetParser to it? I have a set of hosts that send >> awfully formatted messages and the rfc3164 parser seems to parse them fine >> while the rfc5424 parser does not. >> >> I see examples of how to specify the parser in the legacy configuration >> format, but how would I do it in a RainerScript like this? >> >> ruleset(name="centralized_logging"){ >> *.* >> action(type="omfile" dynaFile="DailyPerHostLogs") >> auth,authpriv.* >> action(type="omfile" dynaFile="DailyPerHostLogsAuth") >> cron.* >> action(type="omfile" dynaFile="DailyPerHostLogsCron") >> mail.* >> action(type="omfile" dynaFile="DailyPerHostLogsMail") >> kern.* >> action(type="omfile" dynaFile="DailyPerHostLogsKern") >> local4.* >> action(type="omfile" dynaFile="DailyPerHostLogs") >> local6.* >> action(type="omfile" dynaFile="DailyPerHostLogs") >> & stop >> } >> >> >> listeners.conf: >> >> input(type="imudp" port="10514" ruleset="centralized_logging") >> >> Templates from rsyslog.conf: >> >> template(name="DailyPerHostLogs" type="string" >> string="/syslog/%FROMHOST%/syslog") >> template(name="DailyPerHostLogsAuth" type="string" >> string="/syslog/%FROMHOST%/auth.log") >> template(name="DailyPerHostLogsCron" type="string" >> string="/syslog/%FROMHOST%/cron.log") >> template(name="DailyPerHostLogsKern" type="string" >> string="/syslog/%FROMHOST%/kern.log") >> template(name="DailyPerHostLogsMail" type="string" >> string="/syslog/%FROMHOST%/mail.log") >> >> >> Thanks! >> >> ______________________________________________ >> >> See http://www.peak6.com/email_disclaimer/ for terms and conditions >> related to this email >> _______________________________________________ >> rsyslog mailing list >> http://lists.adiscon.net/mailman/listinfo/rsyslog >> http://www.rsyslog.com/professional-services/ >> What's up with rsyslog? Follow https://twitter.com/rgerhards >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad >> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >> DON'T LIKE THAT. >> >> _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
