On 10/8/15 1:25 PM, David Lang wrote: > even using puppet, I think you can separate out the template generation
Oh sure i can, it would just be a bit of a re-organization. > worst case, create a separate include directory that only includes the > templates and the code that evaluates the templates into variables, then > your actions in the main include directory can use those. Well I just took our config and did that manually outside of puppet on the dev server, in a bit of a hack job. Unfortunately the crashes persist with the same regularity. I am now getting error 6 in the segfault whereas it was 15 before - though I've also had error 6 before and also error 14. However, the actions still called the templates via the dynamic index per day name so maybe it wasn't separated enough. But is there even a way to make it not call the template in that case? So is it only really important to separate out the templates that set up the JSON, or all templates? > But if your various ES things mostly use the template "all" (which is > what I would expect), then you may be able to do something much simpler > than you are thinking. In my case it turned out that I only had 3 > templates that ended up getting used in all the different rules. I use two templates per omelasticsearch - one to define the index name. I currently use a separate template per name - "es_index_name-yyyy.mm.dd" but now I see you're right, I could stick the name into a variable $.es_index_name and use one template for that. There are two content templates - one "all" and one other type. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
