On Thu, 1 Dec 2016, David Lang wrote:

Is there any way to dynamically invoke a ruleset? eg: call $var
(I'm trying to avoid having +200 if statements...


so to summarize, what I recommend that you do for for your use case is:

1. a single combined mmnormalize ruleset

if <condition> then {
set common things
}
$includeconfig /etc/rsyslog.d/apps.d/*.conf
else { unknown app }


in each of the apps.d/*.conf files do

else if <condition> then {
  stuff
}

(as an optimization, make the most common apps the earliest in the directory)

This gets you your custom assignments per app, and the efficient parsing of the logs.

David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of 
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE 
THAT.

Reply via email to