I'm still looking for the example mongodb template you mentioned that includes
the database-level syntax in it; if you have a link I'd appreciate it.
Searching rsyslog.com and the wiki returns results that mostly point to release
announcements; some results do cover MongoDB configuration but do not show the
database-level syntax being used in a template.
I wrapped my previously-mentioned template in MongoDB syntax so it looks like:
$template
mongoTemplate,"db.myCollection.save({%msg:R,ERE,1,BLANK:clientip=([[:digit:]]{1,3}\.[[:digit:]]{1,3}\.[[:digit:]]{1,3}\.[[:digit:]]{1,3})--end:jsonf:msg_clientip%});"
but this didn't log anything to MongoDB. Neither did simple variations like:
$template mongoTemplate,"db.myCollection.save({message: %msg%});" or
$template mongoTemplate,"db.myCollection.save({test: \"Testing\"});"
Thanks again,
Ian
>________________________________
> From: "[email protected]" <[email protected]>
>To: Ian <[email protected]>; rsyslog-users <[email protected]>
>Sent: Monday, August 20, 2012 1:39 PM
>Subject: Re: [rsyslog] Regex logging to MongoDB
>
>On Mon, 20 Aug 2012, Ian wrote:
>
>> I configured a template with regexes for all of the information I want
>> logged:
>>
>> $template
>> jsonTemplate,"{%msg:R,ERE,1,BLANK:username=([A-Za-z0-9_-]+)--end:jsonf:msg_username%,%msg:R,ERE,1,BLANK:clientip=([[:digit:]]{1,3}\.[[:digit:]]{1,3}\.[[:digit:]]{1,3}\.[[:digit:]]{1,3})--end:jsonf:msg_clientip%,
>> ...}"
>>
>> and this logs to a file perfectly. However when I log this same info to
>> MongoDB nothing is logged. I can log a simple, non-json template to MongoDB
>> so I know the connection works correctly. In the docs it says regexes don't
>> work with filtering (I had been using if $app-name == 'myapp' then
>> action(...)) and thought this was the issue, but even when I use the above
>> template with the very straightforward:
>>
>> *.* action(type="ommongodb" server="localhost" serverport="27017"
>> uid="rsyslog" pwd="..." db="..." collection="...")
>>
>> this does not log to the database. I removed the jsonf formatting of the
>> template fields as well, but still no luck. What should I be doing
>> differently here?
>
>Remember that the database templates include everything that is sent to
>the database, this includes the "insert into TABLE X" and trailing ";"
>parts of the syntax.
>
>take a look at the example mongodb template and add this extra syntax
>around the part of the template that you have been working with.
>
>David Lang
>
>
>
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
