Hi David, Here's how the debug template writes with a "server" config like the one I pasted in the first Email:
Debug line with all properties: FROMHOST: 'localhost', fromhost-ip: '127.0.0.1', HOSTNAME: 'rgheorghe-ubuntu', PRI: 46, syslogtag 'rsyslogd', programname: 'rsyslogd', APP-NAME: 'rsyslogd', PROCID: '-', MSGID: '-', TIMESTAMP: 'Nov 3 18:38:09', STRUCTURED-DATA: '-', msg: ' [origin software="rsyslogd" swVersion="8.13.0" x-pid="1623" x-info="http://www.rsyslog.com";] start' escaped msg: ' [origin software="rsyslogd" swVersion="8.13.0" x-pid="1623" x-info="http://www.rsyslog.com";] start' inputname: imtcp rawmsg: '<46>1 2015-11-03T18:38:09.287115+02:00 rgheorghe-ubuntu rsyslogd - - - [origin software="rsyslogd" swVersion="8.13.0" x-pid="1623" x-info="http://www.rsyslog.com";] start' $!: $.: $/: So it sounds like rsyslog parses the RFC5424 message, but mmpstrucdata doesn't seem to put anything in that $! variable. Thanks and best regards, Radu -- Performance Monitoring * Log Analytics * Search Analytics Solr & Elasticsearch Support * http://sematext.com/ On Mon, Nov 2, 2015 at 7:45 PM, David Lang <[email protected]> wrote: > can you show us a same of the rawlog that you are receiving? > > among other things, it shows up with the template RSYSLOG_DebugFormat > > David Lang > > On Mon, 2 Nov 2015, Radu Gheorghe wrote: > >> Date: Mon, 2 Nov 2015 14:13:23 +0200 >> From: Radu Gheorghe <[email protected]> >> Reply-To: rsyslog-users <[email protected]> >> To: rsyslog-users <[email protected]> >> Subject: [rsyslog] mmpstrucdata doesn't seem to work >> >> >> Hello rsysloggers :) >> >> I'm having trouble setting up mmpstrucdata (running on 64-bit Ubuntu >> 14.04 with rsyslog 8.13 installed from the official packages, if it >> matters). >> >> I've followed the docs >> >> (http://www.rsyslog.com/doc/v8-stable/configuration/modules/mmpstrucdata.html) >> and I didn't get anything out of the $! or the $!rfc5424-sd variables. >> I've changed the jsonRoot path - still no go. Tried with $!all-json - >> nothing. And by "nothing", I mean "the contents of these variables are >> always empty". Except for $!all-json, which naturally shows an empty >> JSON. >> >> I see there is a test there on the testbench so I figured I must be >> doing something wrong, then I tried to emulate that. Here's my last >> (failed) attempt: >> >> Server config: >> --------- >> module(load="imtcp") >> module(load="mmpstrucdata") >> >> input(type="imtcp" port="514") >> action(type="mmpstrucdata") >> >> template(name="jsondump" type="string" string="%$!%\n") >> >> action(type="omfile" >> file="/var/log/test" >> template="jsondump") >> --------- >> >> Client config: >> -------- >> module(load="imuxsock") >> >> action(type="omfwd" >> protocol="tcp" >> target="127.0.0.1" >> port="514" >> template="RSYSLOG_SyslogProtocol23Format") >> -------- >> >> If I had to bet, I'd still go for me missing something (as I would >> expect the test to fail otherwise). Can someone confirm that >> mmpstrucdata still works on 8.13 and show an example config? Does >> anyone use this module at all? (I wouldn't blame anyone if they don't >> use it, I prefer JSON in the message anyway :p) >> >> Thanks and best regards, >> Radu >> -- >> Performance Monitoring * Log Analytics * Search Analytics >> Solr & Elasticsearch Support * http://sematext.com/ >> _______________________________________________ >> rsyslog mailing list >> http://lists.adiscon.net/mailman/listinfo/rsyslog >> http://www.rsyslog.com/professional-services/ >> What's up with rsyslog? Follow https://twitter.com/rgerhards >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad >> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T >> LIKE THAT. >> > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > LIKE THAT. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
