2016-12-01 23:30 GMT+01:00 David Lang <da...@lang.hm>:
> On Thu, 1 Dec 2016, David Lang wrote:
>
>>> Is there any way to dynamically invoke a ruleset? eg: call $var
>>> (I'm trying to avoid having +200 if statements...
>
>
> so to summarize, what I recommend that you do for for your use case is:
>
> 1. a single combined mmnormalize ruleset
>
> if <condition> then {
> set common things
> }
> $includeconfig /etc/rsyslog.d/apps.d/*.conf
> else { unknown app }
>
>
> in each of the apps.d/*.conf files do
>
> else if <condition> then {
>   stuff
> }
>
> (as an optimization, make the most common apps the earliest in the
> directory)
>
> This gets you your custom assignments per app, and the efficient parsing of
> the logs.

full ack, but a question to @mostolog

What exactly do you do with the variables you set inside the if body?
Are they always the same? Where does the data originate from?

I try to understand the scenario better, because I vaguely think I may
be able to find a much simpler solution which would require possible
minimal code changes. But I can't express myself clearer at the
moment, it's more a gut feeling.

It would be good if you could post some *concrete* example of three or
four of the if blocks, that would definitely aid understanding.

Rainer
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of 
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE 
THAT.

Reply via email to