This probably was doc fix done after the last stable... Rainer
2015-04-28 9:06 GMT+02:00 Tristan Carel <[email protected]>: > Hello Rainer, > > I have read the v8-stable version of this page a thousands time. Now > that I read the master one, I see it! > Thank you > Tristan Carel > Normal is getting dressed in clothes that you buy for work and driving > through traffic in a car that you are still paying for - in order to > get to the job you need to pay for the clothes and the car, and the > house you leave vacant all day so you can afford to live in it. > > > On Tue, Apr 28, 2015 at 9:01 AM, Rainer Gerhards > <[email protected]> wrote: >> http://www.rsyslog.com/doc/master/configuration/modules/imfile.html?highlight=imfile%20metadata >> >> Rainer >> >> 2015-04-28 8:58 GMT+02:00 Tristan Carel <[email protected]>: >>> Hello, >>> >>> I would like to push every log files contained in a directory to logstash. >>> Here >>> is the config file I attempt to use for that: >>> >>> ----------8<----------8<----------8<----------8<----------8<----------8< >>> *.* @@LOGSTASH_SERVER:514 >>> >>> input(type="imfile" >>> File="/logs/*.log" >>> Tag="myapp" >>> Severity="notice" >>> Facility="local0" >>> ) >>> ----------8<----------8<----------8<----------8<----------8<----------8< >>> >>> Messages are properly forwarded to logstash syslog input server but >>> the `filename' >>> metadata is not part of the pushed messages. >>> >>> I tried forcing some `input' parameters default values but nothing changed: >>> - mode="inotify" >>> - addMetadata="on" >>> >>> I also tried to modify the message `template' to include the `filename` >>> with: >>> template(name="..." type="...") { >>> [...] >>> property(name="filename") >>> [...] >>> } >>> But rsyslog yiells at me because "filename is not a property" ! >>> >>> Do you have any clue I could follow? >>> >>> The new imfile module seems to be just the right tool to prevent using >>> the so-complicated logstash-forwarder. I would like to demonstrate >>> rsyslog capabilities to handle all logs of Docker containers during a >>> meetup I will host in 2 weeks [1]. >>> My B plan is to specify as many `input' as I have log files, but this >>> is what I didn't want to do in the first place. This is not pretty nor >>> generic. >>> >>> Regards >>> -- >>> Tristan Carel >>> Normal is getting dressed in clothes that you buy for work and driving >>> through traffic in a car that you are still paying for - in order to >>> get to the job you need to pay for the clothes and the car, and the >>> house you leave vacant all day so you can afford to live in it. >>> _______________________________________________ >>> rsyslog mailing list >>> http://lists.adiscon.net/mailman/listinfo/rsyslog >>> http://www.rsyslog.com/professional-services/ >>> What's up with rsyslog? Follow https://twitter.com/rgerhards >>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of >>> sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T >>> LIKE THAT. >> _______________________________________________ >> rsyslog mailing list >> http://lists.adiscon.net/mailman/listinfo/rsyslog >> http://www.rsyslog.com/professional-services/ >> What's up with rsyslog? Follow https://twitter.com/rgerhards >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of >> sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T >> LIKE THAT. > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > LIKE THAT. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
