can you show us a same of the rawlog that you are receiving?
among other things, it shows up with the template RSYSLOG_DebugFormat David Lang On Mon, 2 Nov 2015, Radu Gheorghe wrote:
Date: Mon, 2 Nov 2015 14:13:23 +0200 From: Radu Gheorghe <[email protected]> Reply-To: rsyslog-users <[email protected]> To: rsyslog-users <[email protected]> Subject: [rsyslog] mmpstrucdata doesn't seem to work Hello rsysloggers :) I'm having trouble setting up mmpstrucdata (running on 64-bit Ubuntu 14.04 with rsyslog 8.13 installed from the official packages, if it matters). I've followed the docs (http://www.rsyslog.com/doc/v8-stable/configuration/modules/mmpstrucdata.html) and I didn't get anything out of the $! or the $!rfc5424-sd variables. I've changed the jsonRoot path - still no go. Tried with $!all-json - nothing. And by "nothing", I mean "the contents of these variables are always empty". Except for $!all-json, which naturally shows an empty JSON. I see there is a test there on the testbench so I figured I must be doing something wrong, then I tried to emulate that. Here's my last (failed) attempt: Server config: --------- module(load="imtcp") module(load="mmpstrucdata") input(type="imtcp" port="514") action(type="mmpstrucdata") template(name="jsondump" type="string" string="%$!%\n") action(type="omfile" file="/var/log/test" template="jsondump") --------- Client config: -------- module(load="imuxsock") action(type="omfwd" protocol="tcp" target="127.0.0.1" port="514" template="RSYSLOG_SyslogProtocol23Format") -------- If I had to bet, I'd still go for me missing something (as I would expect the test to fail otherwise). Can someone confirm that mmpstrucdata still works on 8.13 and show an example config? Does anyone use this module at all? (I wouldn't blame anyone if they don't use it, I prefer JSON in the message anyway :p) Thanks and best regards, Radu -- Performance Monitoring * Log Analytics * Search Analytics Solr & Elasticsearch Support * http://sematext.com/ _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
_______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
