As I said, you can either use the metadata created by imfile in an if statement
instead of doing *.*
or you can use a ruleset
http://www.rsyslog.com/doc/v8-stable/concepts/multi_ruleset.html
David Lang
On Sat, 3 Jun 2017, saurabh cse wrote:
i am sharing configuration
$template OutFile,"/var/log/%HOSTNAME%/%syslogtag%.log"
if $fromhost-ip startswith '208.68.38.153' then /var/log/test.log
local3.* /var/log*/test.log*
$mmnormalizeRuleBase /tmp/a.rb
*.* :mmnormalize:
#test.* :mmnormalize:
$template cee,"%$!all-json%\n"
*.* /tmp/logfile;cee
in this case, normalize all the log, I want to only normalize a
particular log file (test.log), how we do that
On Sat, Jun 3, 2017 at 10:18 PM, David Lang <[email protected]> wrote:
you can use a filter (based on metadata) to only run the mmnormalize call
when it matches that filter.
you can define a specific rulebase for that input and have the mmnormalize
call be part of that rulebase
David LAng
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
