you can always do
set $.var = exec_template("templatename");and then use the resulting variable in the mmnormalize call.I'm pretty sure variable is documented now, are you sure you were looking at current docs?
David Lang On Fri, 24 Feb 2017, matthew.gaetano wrote:
Date: Fri, 24 Feb 2017 13:21:23 -0700 (MST) From: matthew.gaetano <[email protected]> Reply-To: rsyslog-users <[email protected]> To: [email protected] Subject: Re: [rsyslog] Send logs in JSON format to Elasticsearch Just an FYI: mmnormalize can only take the rawsg or msg rsyslog properties. However there is a undocumented option called "variable" that allows you to instead pass any variable including JSON properties and locally defined. This how we solved the issue as per David's suggestions/comments. action( name="action-name" type="mmnormalize" ruleBase="rulebase-file" path="$!some-variable" variable="input-variable" ) On that note, a comment, it would be nice if mmnormalize would support templated input like many of the other modules. Thanks ~Regards ----- ~Regards Matthew Gaetano -- View this message in context: http://rsyslog-users.1305293.n2.nabble.com/Send-logs-in-JSON-format-to-Elasticsearch-tp7592229p7592238.html Sent from the rsyslog-users mailing list archive at Nabble.com. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
_______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
