Re: [rsyslog] Parse multiple files with different mmnormalize rules

On Thu, 19 Nov 2015, Alec Swan wrote: I am assuming your first suggestion was to use a Tag in imfile input and then filter on that Tag in mmnormalize action. How do I access the tag that was assigned in imfile? the tag in the imfile becomes $programname if $programname='foo' then {} I

Re: [rsyslog] Parse multiple files with different mmnormalize rules

On Thu, 19 Nov 2015, Alec Swan wrote: Hello, I would like to parse multiple log files with mmnormalize actions. However, it is not clear how to specify different parsing rules for different files in a single rsyslog .conf file. If this is possible could anybody provide a sample configuration?

Re: [rsyslog] Parse multiple files with different mmnormalize rules

I am assuming your first suggestion was to use a Tag in imfile input and then filter on that Tag in mmnormalize action. How do I access the tag that was assigned in imfile? I don't understand how I can chain multiple mmnormalize rules if some of them can match logs from different files, e.g. each

Re: [rsyslog] Parse multiple files with different mmnormalize rules

Hi Alec, For each file input you can assign a ruleset. Each ruleset can contain various actions like normalizing. http://www.rsyslog.com/doc/v8-stable/concepts/multi_ruleset.html Regards, Ciprian -- Performance Monitoring * Log Analytics * Search Analytics Solr & Elasticsearch Support *

[rsyslog] Parse multiple files with different mmnormalize rules

Hello, I would like to parse multiple log files with mmnormalize actions. However, it is not clear how to specify different parsing rules for different files in a single rsyslog .conf file. If this is possible could anybody provide a sample configuration? Thanks, Alec

Re: [rsyslog] Parse multiple files with different mmnormalize rules

Ciprian and David, thank you for the great responses. I'll give your recommendations a try and post back if I run into problems. Thanks, Alec On Thu, Nov 19, 2015 at 11:57 AM, David Lang wrote: > On Thu, 19 Nov 2015, Alec Swan wrote: > > I am assuming your first suggestion was