thank for reply, issue has been resolved On Sat, Jun 3, 2017 at 10:35 PM, David Lang <[email protected]> wrote:
> As I said, you can either use the metadata created by imfile in an if > statement instead of doing *.* > > or you can use a ruleset http://www.rsyslog.com/doc/v8- > stable/concepts/multi_ruleset.html > > David Lang > > On Sat, 3 Jun 2017, saurabh cse wrote: > > i am sharing configuration >> >> $template OutFile,"/var/log/%HOSTNAME%/%syslogtag%.log" >> if $fromhost-ip startswith '208.68.38.153' then /var/log/test.log >> local3.* >> /var/log*/test.log* >> $mmnormalizeRuleBase /tmp/a.rb >> >> *.* :mmnormalize: >> #test.* :mmnormalize: >> $template cee,"%$!all-json%\n" >> >> *.* /tmp/logfile;cee >> >> in this case, normalize all the log, I want to only normalize a >> particular log file (test.log), how we do that >> >> >> >> On Sat, Jun 3, 2017 at 10:18 PM, David Lang <[email protected]> wrote: >> >> you can use a filter (based on metadata) to only run the mmnormalize call >>> when it matches that filter. >>> >>> you can define a specific rulebase for that input and have the >>> mmnormalize >>> call be part of that rulebase >>> >>> David LAng >>> >>> >> _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
