2016-12-02 8:27 GMT+01:00 David Lang <da...@lang.hm>:
> On Fri, 2 Dec 2016, Rainer Gerhards wrote:
>> What exactly do you do with the variables you set inside the if body?
>> Are they always the same? Where does the data originate from?
>> I try to understand the scenario better, because I vaguely think I may
>> be able to find a much simpler solution which would require possible
>> minimal code changes. But I can't express myself clearer at the
>> moment, it's more a gut feeling.
>> It would be good if you could post some *concrete* example of three or
>> four of the if blocks, that would definitely aid understanding.
> he gave a couple of examples a while back.
> An example would be populating one variable from several possible sources,
> depending on the log type. In some cases it may require combining multiple
> variables so it can't be solved in the parser

These "possible sources" and "log type" and "multiple variables" are
exactly what I would like to clarify. Depending on the fine details,
there may be a simple solution, maybe not. At least something to think
about. I am thinking about someting along the lines of e.g. imfile
input with an extra metadata parameter, e.g.

metadata=["!var=foo", "!bar=another text"]

But for me it is very hard to really think about it without a concrete
case. Looking at an abstract level, things seem easy, but the rest of
the conversation indicates to me that the abstraction may not
necessarily be correct, so I would like to see the dirty *real life,
real code" that shall be used.

> along the lines of:
> if type = 1 then
>   set var = $foo
> else if type = 2 then
>   set var = $bar
> else if type = 3 then
>   set var = $baz + $bar
> another thing that can be done in this sort of structure is to save
> different logs in different places (type 1 & 2 go in dir A, type 3 goes in
> dir B)
> or writing the different logs using different templates.
> If you look at the rules that I had, you see that I did a lot of that type
> of thing. But I just did it as if statements

Again, it's all to abstract to keep me thinking further into that direction.

I want to avoid that I abstract something based on an already
abstracted idea which might not 100% match reality.

Hope this clarifies,
rsyslog mailing list
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of 
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE 

Reply via email to