On Thu, 19 Nov 2015, Alec Swan wrote:
Hello,
I would like to parse multiple log files with mmnormalize actions. However,
it is not clear how to specify different parsing rules for different files
in a single rsyslog .conf file. If this is possible could anybody provide a
sample configuration?
well, you could do it by having a series of if statements that check the input
or tag.
But you really shouldn't need to do this. If you just combine the definitions
you should be able to have things work.
mmnormalize is designed to be fast and work with very large rulesets (unlike
most regex based systems, which need to have you split up the rules). I
currently have >1300 rules in my rulebase for example.
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
