I am assuming your first suggestion was to use a Tag in imfile input and then filter on that Tag in mmnormalize action. How do I access the tag that was assigned in imfile?
I don't understand how I can chain multiple mmnormalize rules if some of them can match logs from different files, e.g. each file contains three words but each word has different semantics? Thanks, Alec On Thu, Nov 19, 2015 at 11:00 AM, David Lang <[email protected]> wrote: > On Thu, 19 Nov 2015, Alec Swan wrote: > > Hello, >> >> I would like to parse multiple log files with mmnormalize actions. >> However, >> it is not clear how to specify different parsing rules for different files >> in a single rsyslog .conf file. If this is possible could anybody provide >> a >> sample configuration? >> > > well, you could do it by having a series of if statements that check the > input or tag. > > But you really shouldn't need to do this. If you just combine the > definitions you should be able to have things work. > > mmnormalize is designed to be fast and work with very large rulesets > (unlike most regex based systems, which need to have you split up the > rules). I currently have >1300 rules in my rulebase for example. > > David Lang > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
