Perfect, that works. I was hesitating to add staff inside the ruleset but it
was what needed
Thank you a lot!
Regards,
Alexandros
-----Original Message-----
From: Rainer Gerhards <rgerha...@hq.adiscon.com>
Sent: Tuesday, July 2, 2019 2:24 PM
To: Naoum, A. (Alexandros) <alexandros.na...@nn.cz>
Cc: rsyslog-users <rsyslog@lists.adiscon.com>
Subject: Re: [rsyslog] ruleset name as variable
you define it outside of the ruleset! So it is only executed when the default
ruleset is executed. Move it into the ruleset. That's exactly why I needed the
full config ;-)
Rainer
El mar., 2 jul. 2019 a las 14:20, Naoum, A. (Alexandros)
(<alexandros.na...@nn.cz>) escribió:
>
>
> set $!sourcetype = "syslog_checkpoint_ids_test";
> template(name="DynIPFile" type="string"
> string="/var/log/logs/syslog_checkpoint_ids/%FROMHOST-IP%/%FROMHOST-IP
> %.log") template(name="DynIPFile_test" type="string"
> string="/var/log/logs/%$!sourcetype%/%FROMHOST-IP%/%FROMHOST-IP%.log")
> ruleset(name="syslog_checkpoint_ids"
> queue.type="Direct"
> queue.timeoutenqueue="0")
> {
> if $fromhost-ip == [
> "15.112.10.6",
> "15.112.10.5",
> "15.112.10.4",
> ]
> then {
> action(name="action_syslog_checkpoint"
> type="omfile"
> DynaFile="DynIPFile")
> action(name="action_syslog_checkpoint2"
> type="omfile"
> DynaFile="DynIPFile_test")
>
> stop
> }
> }
>
>
> Regards,
> Alexandros
>
> -----Original Message-----
> From: Rainer Gerhards <rgerha...@hq.adiscon.com>
> Sent: Tuesday, July 2, 2019 2:16 PM
> To: Naoum, A. (Alexandros) <alexandros.na...@nn.cz>
> Cc: rsyslog-users <rsyslog@lists.adiscon.com>
> Subject: Re: [rsyslog] ruleset name as variable
>
> full config pls
>
> El mar., 2 jul. 2019 a las 14:13, Naoum, A. (Alexandros)
> (<alexandros.na...@nn.cz>) escribió:
> >
> >
> >
> > That sound better but I'm not sure if I done it correct because doesn't
> > work.
> >
> > I put this line before the ruleset definition:
> >
> > set $!sourcetype = "syslog_checkpoint_test";
> >
> > I have a template:
> >
> > template(name="DynIPFile_test" type="string"
> > string="/var/log/logs/%$!sourcetype%/%FROMHOST-IP%/%FROMHOST-IP%.log
> > ")
> >
> > In the action I have this:
> >
> > action(name="action_syslog_checkpoint2"
> > type="omfile"
> > DynaFile="DynIPFile_test")
> >
> > Regards,
> > Alexandros
> >
> > -----Original Message-----
> > From: Rainer Gerhards <rgerha...@hq.adiscon.com>
> > Sent: Tuesday, July 2, 2019 1:18 PM
> > To: Naoum, A. (Alexandros) <alexandros.na...@nn.cz>
> > Cc: rsyslog-users <rsyslog@lists.adiscon.com>
> > Subject: Re: [rsyslog] ruleset name as variable
> >
> > El mar., 2 jul. 2019 a las 13:15, Naoum, A. (Alexandros)
> > (<alexandros.na...@nn.cz>) escribió:
> > >
> > >
> > > Thank you for the reply.
> > >
> > > It is a good way but in my scenario... probably will not provide what I
> > > want to get.
> > > I want to reuse this variable as part of the file name on omfile module
> > > in multiple rulesets (different sources in each).
> >
> > variables are NOT local to rulesets. If you do not need a stack, you
> > can just use
> >
> > set $.rsname="name";
> > and use that in the template. That's it.
> >
> > Rainer
> > >
> > > So instead of having multiple templates with static parts/names I want to
> > > use one template that will get a part of the file name from the ruleset
> > > (or from the actual .conf file).
> > >
> > >
> > This message (including any attachments) may contain confidential
> > information. It is intended for use by the recipient only. Any
> > dissemination, copying or distribution to third parties without the express
> > consent of the sender is strictly prohibited. If you have received this
> > message in error, please delete it immediately and notify the sender. Thank
> > you for your collaboration.
> This message (including any attachments) may contain confidential
> information. It is intended for use by the recipient only. Any dissemination,
> copying or distribution to third parties without the express consent of the
> sender is strictly prohibited. If you have received this message in error,
> please delete it immediately and notify the sender. Thank you for your
> collaboration.
This message (including any attachments) may contain confidential information.
It is intended for use by the recipient only. Any dissemination, copying or
distribution to third parties without the express consent of the sender is
strictly prohibited. If you have received this message in error, please delete
it immediately and notify the sender. Thank you for your collaboration.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
