http://www.rsyslog.com/doc/master/configuration/modules/imfile.html?highlight=imfile%20metadata
Rainer 2015-04-28 8:58 GMT+02:00 Tristan Carel <[email protected]>: > Hello, > > I would like to push every log files contained in a directory to logstash. > Here > is the config file I attempt to use for that: > > ----------8<----------8<----------8<----------8<----------8<----------8< > *.* @@LOGSTASH_SERVER:514 > > input(type="imfile" > File="/logs/*.log" > Tag="myapp" > Severity="notice" > Facility="local0" > ) > ----------8<----------8<----------8<----------8<----------8<----------8< > > Messages are properly forwarded to logstash syslog input server but > the `filename' > metadata is not part of the pushed messages. > > I tried forcing some `input' parameters default values but nothing changed: > - mode="inotify" > - addMetadata="on" > > I also tried to modify the message `template' to include the `filename` with: > template(name="..." type="...") { > [...] > property(name="filename") > [...] > } > But rsyslog yiells at me because "filename is not a property" ! > > Do you have any clue I could follow? > > The new imfile module seems to be just the right tool to prevent using > the so-complicated logstash-forwarder. I would like to demonstrate > rsyslog capabilities to handle all logs of Docker containers during a > meetup I will host in 2 weeks [1]. > My B plan is to specify as many `input' as I have log files, but this > is what I didn't want to do in the first place. This is not pretty nor > generic. > > Regards > -- > Tristan Carel > Normal is getting dressed in clothes that you buy for work and driving > through traffic in a car that you are still paying for - in order to > get to the job you need to pay for the clothes and the car, and the > house you leave vacant all day so you can afford to live in it. > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > LIKE THAT. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
