Hi Alec, For each file input you can assign a ruleset. Each ruleset can contain various actions like normalizing. http://www.rsyslog.com/doc/v8-stable/concepts/multi_ruleset.html
Regards, Ciprian -- Performance Monitoring * Log Analytics * Search Analytics Solr & Elasticsearch Support * http://sematext.com/ On Thu, Nov 19, 2015 at 9:04 PM, Alec Swan <[email protected]> wrote: > I am assuming your first suggestion was to use a Tag in imfile input and > then filter on that Tag in mmnormalize action. How do I access the tag that > was assigned in imfile? > > I don't understand how I can chain multiple mmnormalize rules if some of > them can match logs from different files, e.g. each file contains three > words but each word has different semantics? > > Thanks, > > Alec > > On Thu, Nov 19, 2015 at 11:00 AM, David Lang <[email protected]> wrote: > > > On Thu, 19 Nov 2015, Alec Swan wrote: > > > > Hello, > >> > >> I would like to parse multiple log files with mmnormalize actions. > >> However, > >> it is not clear how to specify different parsing rules for different > files > >> in a single rsyslog .conf file. If this is possible could anybody > provide > >> a > >> sample configuration? > >> > > > > well, you could do it by having a series of if statements that check the > > input or tag. > > > > But you really shouldn't need to do this. If you just combine the > > definitions you should be able to have things work. > > > > mmnormalize is designed to be fast and work with very large rulesets > > (unlike most regex based systems, which need to have you split up the > > rules). I currently have >1300 rules in my rulebase for example. > > > > David Lang > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com/professional-services/ > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > > DON'T LIKE THAT. > > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
