the line on its own can't function because you first need to declare and set myhostname as a variable. Could you give me the whole rsyslog.conf file, so I can see the context
2016-12-14 10:34 GMT+01:00 mostolog--- via rsyslog < [email protected]>: > line 33: set $!data!myhost=$myhostname; > > > El 14/12/16 a las 10:33, Pascal Withopf escribió: > > Hi, >> >> the error message shows that the error is around line 33. >> >> Could you send me the lines 30-35 of the rsyslog.conf file please. >> >> Regards >> >> 2016-12-14 10:02 GMT+01:00 mostolog--- via rsyslog < >> [email protected]>: >> >> Hi >>> >>> We have found several issues with our relp-file-elastic relay config. >>> Hope >>> you can help us. >>> >>> template(name="json" type="string" string="%$!data%\n") >>> >>> ruleset(name="to-index"){ >>> set $!data=$msg; >>> set $!data!dummy_host=$hostname; >>> set $!data!foo="foo"; >>> action(type="omfile" template="json"...) >>> } >>> >>> Doesn't seem to add myhost/foo to file: >>> >>> { "app": "app1", "file": "\/logs\/apps\/app.log", "group": >>> "mygroup", "msg": "redacted" } >>> >>> Also adding "set $!data!myhost=$myhostname;" to the config above, shows >>> the following error message: >>> >>> ... >>> Shifting token VAR () >>> Entering state 42 >>> Reducing stack by rule 69 (line 222): >>> $1 = token VAR () >>> 4886.851403365:main thread : PROP_INVALID for name 'myhostname' >>> 4886.851406264:main thread : Called LogMsg, msg: error during >>> parsing file /etc/rsyslog.conf, on or before line 33: invalid >>> property 'myhostname' >>> 4886.851435156:main thread : rsyslog/glbl: using '127.0.0.1' as >>> localhost IP >>> rsyslogd: error during parsing file /etc/rsyslog.conf, on or before >>> line 33: invalid property 'myhostname' [v8.23.0 try >>> http://www.rsyslog.com/e/2207 ] >>> -> $$ = nterm expr () >>> ... >>> >>> Regards >>> >>> _______________________________________________ >>> rsyslog mailing list >>> http://lists.adiscon.net/mailman/listinfo/rsyslog >>> http://www.rsyslog.com/professional-services/ >>> What's up with rsyslog? Follow https://twitter.com/rgerhards >>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad >>> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >>> DON'T LIKE THAT. >>> >>> _______________________________________________ >> rsyslog mailing list >> http://lists.adiscon.net/mailman/listinfo/rsyslog >> http://www.rsyslog.com/professional-services/ >> What's up with rsyslog? Follow https://twitter.com/rgerhards >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad >> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >> DON'T LIKE THAT. >> > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
