Hi, the error message shows that the error is around line 33.
Could you send me the lines 30-35 of the rsyslog.conf file please. Regards 2016-12-14 10:02 GMT+01:00 mostolog--- via rsyslog < [email protected]>: > Hi > > We have found several issues with our relp-file-elastic relay config. Hope > you can help us. > > template(name="json" type="string" string="%$!data%\n") > > ruleset(name="to-index"){ > set $!data=$msg; > set $!data!dummy_host=$hostname; > set $!data!foo="foo"; > action(type="omfile" template="json"...) > } > > Doesn't seem to add myhost/foo to file: > > { "app": "app1", "file": "\/logs\/apps\/app.log", "group": > "mygroup", "msg": "redacted" } > > Also adding "set $!data!myhost=$myhostname;" to the config above, shows > the following error message: > > ... > Shifting token VAR () > Entering state 42 > Reducing stack by rule 69 (line 222): > $1 = token VAR () > 4886.851403365:main thread : PROP_INVALID for name 'myhostname' > 4886.851406264:main thread : Called LogMsg, msg: error during > parsing file /etc/rsyslog.conf, on or before line 33: invalid > property 'myhostname' > 4886.851435156:main thread : rsyslog/glbl: using '127.0.0.1' as > localhost IP > rsyslogd: error during parsing file /etc/rsyslog.conf, on or before > line 33: invalid property 'myhostname' [v8.23.0 try > http://www.rsyslog.com/e/2207 ] > -> $$ = nterm expr () > ... > > Regards > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
