On Fri, 24 Feb 2017, matthew.gaetano wrote:
Interesting, didn't think of that. I thought exec_template was only good for formatting a single variable, per say changing the timestamp format. Though i suppose you could populate a variable with the result of the variables using it; if you wanted the entire current set of variables, wouldn't that be less efficient than referring to the template in the same manner as an output module?
not much, the same code is interpreting the template, and that's the expensive part. Copying one variable afterwords is pretty cheap.
when doing mmnormalize, it sure helps avoid ambiguity if you can include the syslogtag in the parsing, but between rfc5424 and rfc3164 (and all the things that don't quite comply with either), you really don't want to have to parse against rawmsg. As a result, I craft a variable that's like the traditional file format and write my mmnormalize rules against it.
If you do find that template processing is too expensive, you can write a string module that does the job in C. When we created these for the standard formats we saw a 10% overall throughput improvement.
And you are correct it is documented :)
I thought it was, but if it wasn't, I wanted to have us catch it :-) David Lang _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
