On Fri, 20 Nov 2015, Alec Swan wrote:
Hello,
I have multiple rulesets where I call mmnormalize. I noticed that I have to
duplicate $! variables in each ruleset for mmnormalize to include them in
the $!all-json variable. Is there a way to avoid this duplication below?
template(name = "es-payload" type="list"){
property(name = "$!all-json")
}
ruleset(name = "cassandra-log") {
* set $!@timestamp = exec_template("timereportedrfc3339"); set
$!host = $hostname;*
action(type = "mmnormalize" rulebase =
"/etc/rsyslog.d/rules/cassandra.log.rb")}
ruleset(name = "cassandra-system") {
* set $!@timestamp = exec_template("timereportedrfc3339"); set
$!host = $hostname;*
action(type = "mmnormalize" rulebase =
"/etc/rsyslog.d/rules/cassandra-system.log.rb")}
my experience has been that if you have a name duplicated, it gets overwritten.
can you give an example fo the log output?
also, why are you running mmnormalize twice instead of just combining the
rulebases?
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
