On Tue, 5 Apr 2016, Giulio Vaccari wrote:
First of all, thank you for yuo reply
Simply i have no more ideas about how to do this!
I'm using rsyslog 7.4.7 (standard centos7)
My first attempt was to create a a Json file using Apache and ship it
using Rsyslog using "imfile"... Seems that it don't work... (json file
is in a valid json format)
Then I try to create a json pattern in rsyslog that mutate a log like
this one:
www.test.example.com 132.168.192.123 TLSv1.2
EABDE-IIA-AES128-GMM-SHDF434 - - 31/03/2016 05:39:47 CEST
VvycA8ErsYMAAClUQhwAAABH - HTTP/1.1 GET 0 /test.txt "" 404 295 "-"
"Mozilla/5.0 (compatible; YandexBot/3.0; +http://yandex.com/bots)" 415 +
661 3860
Andnothing
what is the config that you are trying and failing?
Then I try to ship a json preformatted file using an rsylog pattern!
(Yes, I know, this is stupid but I was really in shorts of ideas... In
my tired mind this "procedure" should be able load the variable from an
apache json log file, load them into the template and ship them to
logstash)... You can immaginate by yourself the result...
So...What is the correct way to proceed??? I find many sites but most of
the are simply not clear or theyr solution don't work for me.
what does the file you are trying to ship look like?
The first thing to do, anytime you have trouble with your output, is to write a
local log in the format RSYSLOG_DebugFormat because that will let you see
exactly what is in every variable. Once you have the variables defined the way
you think they are, then creating a format to chip them to logstash is pretty
easy.
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
