2016-01-26 15:14 GMT+01:00 Radu Gheorghe <[email protected]>:
> Hello, > > Just a ping here with the same issue. This time I'm trying with 8.15 > and I can't use the "alternative" parser because of this. > > Then I realized I have version 1.1.2 installed (that's the liblognorm1 > package). So I guess rsyslog doesn't use liblognorm 2.x because we > don't have a general available release yet, and it's just > experimental? > > Yes, that's the point. There are some nits to iron out, but in general the v2 beta is safe to use. I hope to do the stable release together with the March rsyslog release. Rainer > Best regards, > Radu > -- > Performance Monitoring * Log Analytics * Search Analytics > Solr & Elasticsearch Support * http://sematext.com/ > > > On Wed, Oct 7, 2015 at 12:02 PM, Radu Gheorghe > <[email protected]> wrote: > > Hello, > > > > I'm trying to use this Apache Logs pattern in 8.13 on Ubuntu: > > > https://github.com/rsyslog/liblognorm-rulebases/blob/master/rules/v2/apache_combined.rb > > > > And I remember testing that exact rule on a hand-compiled master of 8.13 > > before it was released. Now it doesn't seem to work both rsyslog and the > > lognormalizer binaries complain: > > > > liblognorm error: invalid field type ' "word", "name"' > > > > Translating the rule to its compact equivalent works like a charm (with > > version=2 still there): > > rule=:%clientip:word% %ident:word% %auth:word% [%timestamp:char-to:]%] > > "%verb:word% %request:word% HTTP/%httpversion:float%" %response:number% > > %bytes:number% "%referrer:char-to:"%" "%agent:char-to:"%"%blob:rest% > > > > Is this a bug in the latest liblognorm release or in packaging or am I > > missing something? > > > > I don't know how to check the liblognorm version included in the package > :( > > > > Best regards, > > Radu > > -- > > Performance Monitoring * Log Analytics * Search Analytics > > Solr & Elasticsearch Support * http://sematext.com/ > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
