On Tue, 29 Mar 2016, Joan wrote:
Hell David,
Thanks for the answer, more or less I did what you recommend, but without
mmnormalize (basically I couldn't find enough information to make it work)
and a hackier way
I created templates based on RSYSLOG_SyslogProtocol23Format (just changing
the PRI value)
template(name="Protocol23DEBUG"
type="string"
string= "<159>1 %TIMESTAMP:::date-rfc3339% %HOSTNAME%
%APP-NAME% %PROCID% %MSGID% %STRUCTURED-DATA%
%msg%\n"
)
template(name="Protocol23INFO"
type="string"
string= "<158>1 %TIMESTAMP:::date-rfc3339% %HOSTNAME%
%APP-NAME% %PROCID% %MSGID% %STRUCTURED-DATA%
%msg%\n"
)
template(name="Protocol23WARN"
type="string"
string= "<156>1 %TIMESTAMP:::date-rfc3339% %HOSTNAME%
%APP-NAME% %PROCID% %MSGID% %STRUCTURED-DATA%
%msg%\n"
)
And then do the conditional sending with
if $msg contains 'INFO' then {
local3.* @@192.168.1.10:514;Protocol23INFO
} else if $msg contains 'DEBUG' then {
local3.* @@192.168.1.10:514;Protocol23DEBUG
} else if $msg contains 'WARN' then {
local3.* @@192.168.1.10:514;Protocol23WARN
} else {
local3.* @@192.168.1.10:514;RSYSLOG_SyslogProtocol23Format
}
Any pointers on doing this with a single template?
$template fixup,"<%$.pri%>1 %TIMESTAMP:::date-rfc3339% %HOSTNAME% %APP-NAME%
%PROCID% %MSGID% %STRUCTURED-DATA% %msg%\n"
if $msg contains 'INFO' then {
set $.pri = "158";
} else if $msg contains 'DEBUG' then {
set $.pri = "159";
} else if $msg contains 'WARN' then {
set $.pri = "156";
} else {
set $.pri = "150";
}
local3.* @@192.168.1.10:514;fixup
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
