Hi, The doc is very confusing, especially that part which shows examples with "date-*" date format:
https://www.rsyslog.com/doc/v8-stable/configuration/templates.html However, other part of the doc shows examples without the "date-" in date format. Remove all the "date-" in dateformat fields and it'll work as expected. e.g. dateformat="year" IMO, this might be a bug, either in the doc or in the program. Flo On Fri, Nov 23, 2018 at 11:43 PM Jason Marshall <[email protected]> wrote: > Hi all, I'm sure I'm doing something stupid that's causing this not to > work. > > I am trying to format the logs coming in on local1.info so that they are > saved in a separate file, and have a custom date-stamp vs the other logs > that are being written to other files. > > I am using rsyslog v8.24 on CentOS 7.5 if this is correct: > > # rpm -qa |grep rsyslog > rsyslog-8.24.0-16.el7_5.4.x86_64 > > Here is my template: > > template (name="local1template" type="list") { > property(name="timereported" dateformat="date-year") > constant(value="-") > property(name="timereported" dateformat="date-month") > constant(value="-") > property(name="timereported" dateformat="date-day") > constant(value=" ") > property(name="timereported" dateformat="date-hour") > constant(value=":") > property(name="timereported" dateformat="date-minute") > constant(value=":") > property(name="timereported" dateformat="date-second") > constant(value=" ") > property(name="timereported" dateformat="date-wdayname") > constant(value=" ") > property(name="hostname") > constant(value=" ") > property(name="syslogtag") > constant(value=" ") > property(name="msg") > constant(value="\n") > } > > and my binding: > > local1.* action(type="omfile" file="/var/log/jmtest.log" > template="local1template") > > When I restart rsyslogd, I eithe get nothing logged from local1.info, or > it falls through to the 'messages' file. > > When I run rsyslogd in debug mode, it complains that it doesn't like > 'dateformat="date-year"'. I commented out that part, and it then > complained about 'dateformat="date-month"'. > > It's very unclear to me what I should be putting in this template. It's > also unclear whether I'm going about this correctly at all. Should I be > using the property-replacer instead somehow? How would that even work > here? > > Thanks everyone, sorry if this is in the doc somewhere, but if it is I > haven't been able to find (or perhaps recognize) it. > > --- > Jason Marshall > Katalyst Data Management > www.katalystdm.com | www.seismiczone.com > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
