First of all, thank you for yuo reply Simply i have no more ideas about how to do this!
I'm using rsyslog 7.4.7 (standard centos7) My first attempt was to create a a Json file using Apache and ship it using Rsyslog using "imfile"... Seems that it don't work... (json file is in a valid json format) Then I try to create a json pattern in rsyslog that mutate a log like this one: www.test.example.com 132.168.192.123 TLSv1.2 EABDE-IIA-AES128-GMM-SHDF434 - - 31/03/2016 05:39:47 CEST VvycA8ErsYMAAClUQhwAAABH - HTTP/1.1 GET 0 /test.txt "" 404 295 "-" "Mozilla/5.0 (compatible; YandexBot/3.0; +http://yandex.com/bots)" 415 + 661 3860 Andnothing Then I try to ship a json preformatted file using an rsylog pattern! (Yes, I know, this is stupid but I was really in shorts of ideas... In my tired mind this "procedure" should be able load the variable from an apache json log file, load them into the template and ship them to logstash)... You can immaginate by yourself the result... So...What is the correct way to proceed??? I find many sites but most of the are simply not clear or theyr solution don't work for me. Again, many thanks to anyone who had the kindness to give some answer to a man that is really going mad! On 05/04/2016 12:48, Rainer Gerhards wrote: > 2016-04-05 12:46 GMT+02:00 Giulio Vaccari <[email protected]>: >> Hi all >> >> I have a really simply question but it is going driving me crazy. >> Can I ship apache logs in json format using rsyslog? (from Rsyslog to >> logstash to be accurate) >> More I try, more I fail! At this point I don't know if this really >> possible or not! > yes, it's possible, but it's hard to say what your problem may be > without knowning details. > > Rainer >> Thank to anyone who had the kindness to give me an answer. >> >> _______________________________________________ >> rsyslog mailing list >> http://lists.adiscon.net/mailman/listinfo/rsyslog >> http://www.rsyslog.com/professional-services/ >> What's up with rsyslog? Follow https://twitter.com/rgerhards >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of >> sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T >> LIKE THAT. > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > LIKE THAT. > > AVVISO DI RISERVATEZZA Informazioni riservate possono essere contenute nel > messaggio o nei suoi allegati. Se non siete i destinatari indicati nel > messaggio, o responsabili per la sua consegna alla persona, o se avete > ricevuto il messaggio per errore, siete pregati di non trascriverlo, copiarlo > o inviarlo ad alcuno. In tal caso vi invitiamo a cancellare il messaggio ed i > suoi allegati. Grazie. > CONFIDENTIALITY NOTICE Confidential information may be contained in this > message or in its attachments. If you are not the addressee indicated in this > message, or responsible for message delivering to that person, or if you have > received this message in error, you may not transcribe, copy or deliver this > message to anyone. In that case, you should delete this message and its > attachments. Thank you. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
