Hello,
I would like to push every log files contained in a directory to logstash. Here
is the config file I attempt to use for that:
----------8<----------8<----------8<----------8<----------8<----------8<
*.* @@LOGSTASH_SERVER:514
input(type="imfile"
File="/logs/*.log"
Tag="myapp"
Severity="notice"
Facility="local0"
)
----------8<----------8<----------8<----------8<----------8<----------8<
Messages are properly forwarded to logstash syslog input server but
the `filename'
metadata is not part of the pushed messages.
I tried forcing some `input' parameters default values but nothing changed:
- mode="inotify"
- addMetadata="on"
I also tried to modify the message `template' to include the `filename` with:
template(name="..." type="...") {
[...]
property(name="filename")
[...]
}
But rsyslog yiells at me because "filename is not a property" !
Do you have any clue I could follow?
The new imfile module seems to be just the right tool to prevent using
the so-complicated logstash-forwarder. I would like to demonstrate
rsyslog capabilities to handle all logs of Docker containers during a
meetup I will host in 2 weeks [1].
My B plan is to specify as many `input' as I have log files, but this
is what I didn't want to do in the first place. This is not pretty nor
generic.
Regards
--
Tristan Carel
Normal is getting dressed in clothes that you buy for work and driving
through traffic in a car that you are still paying for - in order to
get to the job you need to pay for the clothes and the car, and the
house you leave vacant all day so you can afford to live in it.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
