On Wed, 21 Dec 2016, mostolog--- via rsyslog wrote:
Hi
(Moving from grok to liblognorm) We are trying to store a literal as a
variable, as we were doing using grok. eg: (?<cmd>ACCEPT)
We aren't sure if this is correct:
rule=:%{"type":"literal", "text":"a", "name":"var"}%
As stated in
http://www.liblognorm.com/files/manual/configuration.html#full-json-format
/*the literal text shall not be stored inside an output variable*;
for this reason no name attribute is given (we could also have used
"name":"-" which achives the same effect but is more verbose)./
Does this means we shouldn't store the literal as variable? What If we
need to?
you can set a variable to a fixed value as an ammend, or try to use word instead
of literal for the item (if this doesn't make the match ambiguous)
or, depending on what you are needing the literal for, you may be able to set it
as a tag.
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
