Am 16.03.2013 22:11, schrieb Reinaldo Gil Lima de Carvalho: > We need a structured log to avoid parsing. I talk with Wietse in the year > 2011 at FISL conference (Porto Alegre/Brasil). > > The second problem is load this data to a database. Rsyslog put the data in a > single column, and use full text search is inevitable. > > While don't have a better solution, I wrote a daemon to parse and insert the > data on a database. I will search this code and put on github on next week. > > []'s >
I use something similar for apache with syslog-ng. It can adapted for each message-string: http://blog.schaal-24.de/?p=769&lang=en Using syslog-ng you can easily split each log-message in different parts and than store each part of the message in a different column. Maybe this is possible with ryslog, too. regards Florian
