Ways of Describing an action

classic Classic list List threaded Threaded
5 messages Options
Luv
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Ways of Describing an action

Luv
When writing action in legacy format like this,

:ommysql:dbhost,dbname,dbuser,dbpassword;dbtemplate ,

Do the order of the parameters matter ? If yes, how can we possibly know the order ? If no, please tell the right way.

I want to use it on omelasticsearch.
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: Ways of Describing an action

Rainer Gerhards
- they matter
- have a look at the doc
- it is strongly discouraged to use legacy format for complex things like this

Rainer

2017-06-15 17:09 GMT+02:00 Luv via rsyslog <[hidden email]>:

> When writing action in legacy format like this,
>
> :ommysql:dbhost,dbname,dbuser,dbpassword;dbtemplate ,
>
> Do the order of the parameters matter ? If yes, how can we possibly know the
> order ? If no, please tell the right way.
>
> I want to use it on omelasticsearch.
>
>
>
> --
> View this message in context: http://rsyslog-users.1305293.n2.nabble.com/Ways-of-Describing-an-action-tp7592483.html
> Sent from the rsyslog-users mailing list archive at Nabble.com.
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Luv
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: Ways of Describing an action

Luv
Okay cool !

I want to use filtering on messages and I think this legacy format is good for that.

Like in rsyslog.conf file,

*.*;auth,authpriv.none          -/var/log/syslog

I want to filter on the syslog tag, so how can I possibly do that ?

:$syslogtag, isequal, "nginx" action(type="omelasticsearch" ......)

Will the above configuration work accordingly ?

Luv
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: Ways of Describing an action

Luv
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: Ways of Describing an action

David Lang
In reply to this post by Luv

On Thu, 15 Jun 2017, Luv via rsyslog wrote:

> Okay cool !
>
> I want to use filtering on messages and I think this legacy format is good
> for that.
>
> Like in rsyslog.conf file,
>
> *.*;auth,authpriv.none          -/var/log/syslog

this is still a good way to filter.

> I want to filter on the syslog tag, so how can I possibly do that ?
>
> :$syslogtag, isequal, "nginx" action(type="omelasticsearch" ......)

this will work, but

if $syslogtag == "nginx" then action()

or if you have multiple things being done based on a single test

if $syslogtag == "nginx" then {
   action()
   action()
}

is easier for people to understand without puzzling out rsyslog specific syntax.
On old versions of rsyslog, this was slower than the example you use, but on
current versions, the config optimizer eliminates the speed difference

David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Loading...