Thanks, Rainer! I knew I was missing something basic (i.e. wrong version) :p -- Performance Monitoring * Log Analytics * Search Analytics Solr & Elasticsearch Support * http://sematext.com/
On Tue, Jan 26, 2016 at 4:16 PM, Rainer Gerhards <[email protected]> wrote: > 2016-01-26 15:14 GMT+01:00 Radu Gheorghe <[email protected]>: > >> Hello, >> >> Just a ping here with the same issue. This time I'm trying with 8.15 >> and I can't use the "alternative" parser because of this. >> >> Then I realized I have version 1.1.2 installed (that's the liblognorm1 >> package). So I guess rsyslog doesn't use liblognorm 2.x because we >> don't have a general available release yet, and it's just >> experimental? >> >> > Yes, that's the point. There are some nits to iron out, but in general the > v2 beta is safe to use. I hope to do the stable release together with the > March rsyslog release. > > Rainer > > >> Best regards, >> Radu >> -- >> Performance Monitoring * Log Analytics * Search Analytics >> Solr & Elasticsearch Support * http://sematext.com/ >> >> >> On Wed, Oct 7, 2015 at 12:02 PM, Radu Gheorghe >> <[email protected]> wrote: >> > Hello, >> > >> > I'm trying to use this Apache Logs pattern in 8.13 on Ubuntu: >> > >> https://github.com/rsyslog/liblognorm-rulebases/blob/master/rules/v2/apache_combined.rb >> > >> > And I remember testing that exact rule on a hand-compiled master of 8.13 >> > before it was released. Now it doesn't seem to work both rsyslog and the >> > lognormalizer binaries complain: >> > >> > liblognorm error: invalid field type ' "word", "name"' >> > >> > Translating the rule to its compact equivalent works like a charm (with >> > version=2 still there): >> > rule=:%clientip:word% %ident:word% %auth:word% [%timestamp:char-to:]%] >> > "%verb:word% %request:word% HTTP/%httpversion:float%" %response:number% >> > %bytes:number% "%referrer:char-to:"%" "%agent:char-to:"%"%blob:rest% >> > >> > Is this a bug in the latest liblognorm release or in packaging or am I >> > missing something? >> > >> > I don't know how to check the liblognorm version included in the package >> :( >> > >> > Best regards, >> > Radu >> > -- >> > Performance Monitoring * Log Analytics * Search Analytics >> > Solr & Elasticsearch Support * http://sematext.com/ >> _______________________________________________ >> rsyslog mailing list >> http://lists.adiscon.net/mailman/listinfo/rsyslog >> http://www.rsyslog.com/professional-services/ >> What's up with rsyslog? Follow https://twitter.com/rgerhards >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad >> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >> DON'T LIKE THAT. >> > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > LIKE THAT. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
