2018-03-18 4:27 GMT+01:00 putcha narayana <[email protected]>: > Hi, > > > Rainer, Appreciate your response. I tried your advise using FileFormat > template as show below but the HOSTNAME is blank in the output. > > > set $.MYCUSTOMIZEDHOSTNAME = "TESTHOSTNAME"; > template(name="TestFileFormat" type="string" string="%timereported:::date- > rfc3339%.%timereported:::date-subseconds% %syslogseverity-text% > %$.MYCUSTOMIZEDHOSTNAME% %syslogtag:R,ERE,1,FIELD:^(.*) > :--end%:%$!msg:::sp-if-no-1st-sp%%$!msg:::drop-cc%\n") > > > *Output:* > > 2018-03-16T12:32:57.159690+05:30.159690 info TESTPROCESS[1200]: Testing > templates Using a Variable. > > > I am missing something basic here. Please share your inputs. > > > Thanks and Regards > > Lak. > > ------------------------------ > *From:* Rainer Gerhards <[email protected]> > *Sent:* Thursday, March 15, 2018 8:14 AM > *To:* rsyslog-users > *Cc:* putcha narayana > *Subject:* Re: [rsyslog] Using local/global variables in templates > > template(name="ForwardFormat" type="string" > string="<%PRI%>%TIMESTAMP:::date-rfc3339% > %$.MYCUSTOMIZEDHOSTNAME%%syslogtag:1:32%%msg:::sp-if-no-1st-sp%%msg%\n") > > HTH > Rainer > > 2018-03-15 5:31 GMT+01:00 putcha narayana via rsyslog > <[email protected]>: > > Hi, > > > > > > I have defined the templates (enclosed at the end of the mail) for > logging locally into a file and to forward to remote syslog server. > > > > > > Question: For the "ForwardFormat" Template can we replace %HOSTNAME% > with a variable. > > > > > > I am able to replace it with a fixed string. i.e., Replacing %HOSTNAME% > with MYCUSTOMIZEDHOSTNAME will have the MYCUSTOMIZEDHOSTNAME in the logs > sent to remote syslog server. I used $MYCUSTOMIZEDHOSTNAME but the output > log as $MYCUSTOMIZEDHOSTNAME > > > > > > Can we replace MYCUSTOMIZEDHOSTNAME with a Variable > $.MYCUSTOMIZEDHOSTNAME or $@MYCUSTOMIZEDHOSTNAME, assign a value to it, use > it in the template such that the value of the variable will be seen in logs. > > > > > > Templates: > > > > template(name="FileFormat" type="string" string="%timereported:::date- > rfc3164%.%timereported:::date-subseconds% %syslogseverity-text% > %HOSTNAME:F,46:1:uppercase% %syslogtag:R,ERE,1,FIELD:^(.*) > :--end%:%msg:::sp-if-no-1st-sp%%msg:::drop-cc%\n") > > > > > > template(name="ForwardFormat" type="string" > > string="<%PRI%>%TIMESTAMP:::date-rfc3339% > %HOSTNAME% %syslogtag:1:32%%msg:::sp-if-no-1st-sp%%msg%\n") > > > > > > > > Modified Template: > > > > template(name="ForwardFormat" type="string" > > string="<%PRI%>%TIMESTAMP:::date-rfc3339% > $MYCUSTOMIZEDHOSTNAME %syslogtag:1:32%%msg:::sp-if-no-1st-sp%%msg%\n") > > > > > > Output: > > > > 2018-03-15T09:37:07.902786+05:30.902786 info $MYCUSTOMIZEDHOSTNAME > TESTPROCESS[1200]: Testing templates Using a Variable. > > > > > > Note: I don't want to set "$LocalHostName yourhostname" because the logs > logged to a file on the local disc should have the HOSTNAME. > > > > > > Appreciate your help >
We need your full config to help. Rainer > > > > Thanks and Regards > > > > Lak. > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > rsyslog Info Page - lists.adiscon.net > <http://lists.adiscon.net/mailman/listinfo/rsyslog> > lists.adiscon.net > Mailing list for rsyslog users. Used for discussion, questions, > suggestions and everything else that helps. This is a PUBLIC list that is > archived by a myriad of sites. > > > > > http://www.rsyslog.com/professional-services/ > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
