On Thu, 18 Jun 2015, Brian Knox wrote:
On the subject of templates - I have cases where being able to use
different templates on the same output action would be advantageous. If an
override variable as proposed here would accomplish that, it would solve a
problem for me.
It's something I work around in various ways now so it's not critical - it
would just be a nice to have.
exactly, I jump through quite a few messy hoops to fix up a few sources that do
some wrong things and then have the result go to the same place as logs that
don't need fixups (or need different fixups). This sort of override would
simplify things a fair bit.
David Lang
On Thu, Jun 18, 2015 at 4:47 AM, Rainer Gerhards <[email protected]>
wrote:
2015-06-18 8:31 GMT+02:00 David Lang <[email protected]>:
There are so many cases where someone needs to override something in the
default template (bad hostname, bad programname, etc) that having to
create
a custom tempalte for each thing gets to be a hassle.
I'd like to propose that we have some templates that are exactly the
same as
the default ones, but that look (for example) for $.hostname and if it's
set, use that instead of $hostname. Have this setup for everything in the
default template set.
I don't know if we dare to do this to the existing templates, or if these
would need to be new templates. If new, could they be built-in, or should
they be string modules that are explicitly loaded (and if string modules,
could they override the default definitions??)
This doesn't sound too trivial.
I also think that we need to have a couple of JSON based templates:
file and forwarding versions of the base templates that use $! for the
message body instead of $msg (do we need a version with '@cee:? or can we
modify mmjsonparse to have an option to no longer require that now that
cee
is dead?)
Either way is possible, and adding such a thing *is* trivial.
and finally a template that is just "$!\n" to use when forwarding to
other
tools (nxlog, logstash, etc)
do we really need this? As of my understanding, they thros the \n away
in json parsing. Or do you mean as part of TCP syslog framing?
Rainer
thoughts?
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T
LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
