Hi Ronnie, syslog.sender is a NiFi specific attribute that is populated by ListenSyslog with the host/ip that created the connection to NiFi, it is not specific to syslog itself.
syslog.hostname is the host that produced the actual log message and was parsed out from the syslog message, this host may or may not be the same as your syslog server. The JSON examples you posted both look like JSON documents representing all of the attributes from a NiFi Flow Flow, but you mentioned that one was going directly from a server to an analytic engine. Could you elaborate a little more on what your NiFi flow is doing? Thanks, Bryan On Fri, Apr 29, 2016 at 2:57 PM, Ronnie Dove <[email protected]> wrote: > Hello, > > Do you guys know if its possible to send a syslog message on behalf of > another server? For example we have all our syslog data coming into NiFi > and would like to PutSyslog to an analytic engine which accepts syslog > data. However, that analytic engine thinks the IP address that the data is > coming from is the IP address of NiFi. We were able to setup through NiFi > GUI all the other properties to pull the appropriate data using NiFi > expression but the IP is the missing piece. I am guessing the socket > connection itself is what the engine is looking at for the IP. But I > wanted to confirm that there was no other way to send an "Sender IP" over > customized. For example: > > DATA COMING DIRECTLY FROM A SERVER TO ANALYTIC ENGINE (Notice > syslog.sender): > > { > "syslog.sender":"/192.168.1.250", > "RouteText.Group":"", > "syslog.severity":"6", > "syslog.body":"test message", > "syslog.priority":"38", > "syslog.facility":"4", > "mime.type":"text/plain", > "RouteText.Route":"unmatched", > "uuid":"817cea69-bc2e-4f84-8ff7-faaa5bee978e", > "syslog.protocol":"UDP", > "path":"./", > "filename":"938709598588638", > "syslog.timestamp":"Apr 29 14:03:27", > "syslog.valid":"true", > "syslog.port":"514", > "syslog.hostname":"spiceworks" > } > > > DATA COMING FROM NIFI ON BEHALF OF ANOTHER SERVER: (Notice the Send IP will > say the IP of NiFi): > > { > "syslog.sender":"/192.168.1.17", <--- This is my concern currently... > "syslog.severity":"6", > "syslog.version":"6", > "syslog.body":"test message", > "syslog.priority":"38", > "syslog.facility":"4", > "mime.type":"text/plain", > "uuid":"36918325-5fdf-4bb8-ba3a-0b40f2b76944", > "syslog.protocol":"UDP", > "path":"./", > "filename":"938588391613315", > "syslog.timestamp":"Apr 29 14:03:27", > "syslog.valid":"true", > "syslog.port":"510", > "syslog.hostname":"spiceworks" > } >
