Re: [rsyslog] IETF template?

2018-06-29 Thread Delon Lee Di Lun via rsyslog
Hi, Here you go. [image: image.png] On Thu, 28 Jun 2018 at 11:26 David Lang wrote: > unfortunantly the first of the two images didn't come through for me, can > you > try again? > > David Lang > > On Wed, 27 Jun 2018, Delon Lee Di Lun wrote: > > > Date: Wed, 27 Jun 2018 17:24:37 +0800 > >

Re: [rsyslog] mmnormalize/mmkubernetes matching problem

2018-06-29 Thread David Lang
One other thing that I would like to see is an example of "I have the namespace and pod name for this log, now go fetch the data from the API for me". When does that happen?  That is, what is the use case when you are not immediately trying to annotate the log record after reading it from the

Re: [rsyslog] mmnormalize/mmkubernetes matching problem

2018-06-29 Thread David Lang
On Fri, 29 Jun 2018, Rich Megginson via rsyslog wrote: On 06/29/2018 06:49 PM, David Lang wrote: On Fri, 29 Jun 2018, Rich Megginson via rsyslog wrote: On 06/29/2018 03:08 PM, David Lang wrote: the filename I have is: $!:{ "metadata": { "filename":

Re: [rsyslog] mmnormalize/mmkubernetes matching problem

2018-06-29 Thread Rich Megginson via rsyslog
On 06/29/2018 06:49 PM, David Lang wrote: On Fri, 29 Jun 2018, Rich Megginson via rsyslog wrote: On 06/29/2018 03:08 PM, David Lang wrote: the filename I have is: $!:{ "metadata": { "filename":

Re: [rsyslog] mmnormalize/mmkubernetes matching problem

2018-06-29 Thread David Lang
On Fri, 29 Jun 2018, Rich Megginson via rsyslog wrote: On 06/29/2018 03:08 PM, David Lang wrote: the filename I have is: $!:{ "metadata": { "filename": "\/var\/log\/containers\/calico-node-jlhg5_kube-system_calico-node-e9abcaf4367e0264243c955699cd0987ff610df33fc9299facb97d1cb97aca2b.log",

Re: [rsyslog] mmnormalize/mmkubernetes matching problem

2018-06-29 Thread Rich Megginson via rsyslog
On 06/29/2018 03:08 PM, David Lang wrote: the filename I have is: $!:{ "metadata": { "filename": "\/var\/log\/containers\/calico-node-jlhg5_kube-system_calico-node-e9abcaf4367e0264243c955699cd0987ff610df33fc9299facb97d1cb97aca2b.log", "fileoffset": "553373" } } the rule that should match it

[rsyslog] mmnormalize/mmkubernetes matching problem

2018-06-29 Thread David Lang
the filename I have is: $!:{ "metadata": { "filename": "\/var\/log\/containers\/calico-node-jlhg5_kube-system_calico-node-e9abcaf4367e0264243c955699cd0987ff610df33fc9299facb97d1cb97aca2b.log", "fileoffset": "553373" } } the rule that should match it is: