Just a side-note: I know the doc is bad. I try my best to make improvements whenever I have time. But it would really be helpful if others would invest a minute here or there to fix things that they see to be wrong or hard to understand. Usually it's done within a few minutes and it not only helps your peers but maybe yourself in the future (when memory has vanished).
You can even use the github online editor to craft updates: https://github.com/rsyslog/rsyslog-doc/tree/master/source Rainer El lun., 26 nov. 2018 a las 9:53, Flo Rance via rsyslog (<[email protected]>) escribió: > > Hi, > > The doc is very confusing, especially that part which shows examples with > "date-*" date format: > > https://www.rsyslog.com/doc/v8-stable/configuration/templates.html > > However, other part of the doc shows examples without the "date-" in date > format. > > Remove all the "date-" in dateformat fields and it'll work as expected. > > e.g. dateformat="year" > > IMO, this might be a bug, either in the doc or in the program. > > Flo > > > On Fri, Nov 23, 2018 at 11:43 PM Jason Marshall <[email protected]> > wrote: > > > Hi all, I'm sure I'm doing something stupid that's causing this not to > > work. > > > > I am trying to format the logs coming in on local1.info so that they are > > saved in a separate file, and have a custom date-stamp vs the other logs > > that are being written to other files. > > > > I am using rsyslog v8.24 on CentOS 7.5 if this is correct: > > > > # rpm -qa |grep rsyslog > > rsyslog-8.24.0-16.el7_5.4.x86_64 > > > > Here is my template: > > > > template (name="local1template" type="list") { > > property(name="timereported" dateformat="date-year") > > constant(value="-") > > property(name="timereported" dateformat="date-month") > > constant(value="-") > > property(name="timereported" dateformat="date-day") > > constant(value=" ") > > property(name="timereported" dateformat="date-hour") > > constant(value=":") > > property(name="timereported" dateformat="date-minute") > > constant(value=":") > > property(name="timereported" dateformat="date-second") > > constant(value=" ") > > property(name="timereported" dateformat="date-wdayname") > > constant(value=" ") > > property(name="hostname") > > constant(value=" ") > > property(name="syslogtag") > > constant(value=" ") > > property(name="msg") > > constant(value="\n") > > } > > > > and my binding: > > > > local1.* action(type="omfile" file="/var/log/jmtest.log" > > template="local1template") > > > > When I restart rsyslogd, I eithe get nothing logged from local1.info, or > > it falls through to the 'messages' file. > > > > When I run rsyslogd in debug mode, it complains that it doesn't like > > 'dateformat="date-year"'. I commented out that part, and it then > > complained about 'dateformat="date-month"'. > > > > It's very unclear to me what I should be putting in this template. It's > > also unclear whether I'm going about this correctly at all. Should I be > > using the property-replacer instead somehow? How would that even work > > here? > > > > Thanks everyone, sorry if this is in the doc somewhere, but if it is I > > haven't been able to find (or perhaps recognize) it. > > > > --- > > Jason Marshall > > Katalyst Data Management > > www.katalystdm.com | www.seismiczone.com > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com/professional-services/ > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > > DON'T LIKE THAT. > > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > LIKE THAT. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
