Hello David,
thanks for suggestions. Actually I used RSYSLOG_DebugFormat to identify
whole CEE chain. Also thanks for that recommendation to avoiding regex,
but shared code is not exactly the one I used. I'm checking IP addresses
in my case, so this is not applicable. Maybe with some additional
functions like ipv4tonum - I'll maybe give it a try. Actually I just
found it's possible to use re_match on structured-data after all, I just
had a typo in my original regex. Anyway at least I'm a bit more familiar
with structured data processing now :-)
Regards,
Petr
On 07.08.2019 11:10, David Lang wrote:
On Wed, 7 Aug 2019, Petr Vyhnal via rsyslog wrote:
Hello all,
finally I managed to make it work as I need. Below is snip of config
I used - just in case someone else tries to achieve something similar.
Example message:
<34>1 2003-10-11T22:14:15.003Z mymachine.example.com su - ID47
[exampleSDID@32473 iut="3" eventSource="Application"
eventID="1011"][id@2 test="tast"] BOM'su root' failed for lonvick on
/dev/pts/8
Code:
$template RFC5424-to-file,"%TIMESTAMP:::date-rfc3339% %HOSTNAME%
%syslogtag% %PROCID% %MSGID% %STRUCTURED-DATA% %msg%\n"
module(load="mmpstrucdata")
if $structured-data != '-' then {
action(type="mmpstrucdata")
at this point, write the log to the template RSYSLOG_DebugFormat and
you can see how it is parsed into the $! variable namespace
if re_match($!rfc5424-sd!exampleSDID@32473!eventID, '10[0-2][0-9]')
you could also say
if $!rfc5424-sd!exampleSDID@32473!eventID >=10000 and
$!rfc5424-sd!exampleSDID@32473!eventID <=1029
that would be more efficient than a regex
David Lang
then {
action(type="omfile" File="/var/log/eventid_1000-1029.log"
template="RFC5424-to-file")
}
}
Regards,
Petr
On 06.08.2019 15:34, Petr Vyhnal via rsyslog wrote:
Hello all,
did anyone tried to do a filtering of messages in structured data
format? Seems common re_match can't be used on $structured-data
property. It doesn't show error, but I can't get any positive match.
I found there is mmpstrucdata module which can parse structured
format into JSON variable tree, but not sure if these variables
could be somehow used in RainerScript if - then declarations. Spent
a lot of time trying to find some answer in forums, but I found
nothing similar to what I need. Any ideas are welcome.
Regards,
Petr
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
POST if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
POST if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
