Hi Ian, If you turn rsyslog and/or mongodb to Debug, do you see any clues in the logs?
I don't know the answer to your specific question, but this always helped me when I had similar trouble with Elasticsearch. 2012/8/21 Ian <[email protected]> > I'm still looking for the example mongodb template you mentioned that > includes the database-level syntax in it; if you have a link I'd appreciate > it. Searching rsyslog.com and the wiki returns results that mostly point > to release announcements; some results do cover MongoDB configuration but > do not show the database-level syntax being used in a template. > > I wrapped my previously-mentioned template in MongoDB syntax so it looks > like: > $template > mongoTemplate,"db.myCollection.save({%msg:R,ERE,1,BLANK:clientip=([[:digit:]]{1,3}\.[[:digit:]]{1,3}\.[[:digit:]]{1,3}\.[[:digit:]]{1,3})--end:jsonf:msg_clientip%});" > > > but this didn't log anything to MongoDB. Neither did simple variations > like: > $template mongoTemplate,"db.myCollection.save({message: %msg%});" or > > $template mongoTemplate,"db.myCollection.save({test: \"Testing\"});" > > > Thanks again, > Ian > > > > > >________________________________ > > From: "[email protected]" <[email protected]> > >To: Ian <[email protected]>; rsyslog-users < > [email protected]> > >Sent: Monday, August 20, 2012 1:39 PM > >Subject: Re: [rsyslog] Regex logging to MongoDB > > > >On Mon, 20 Aug 2012, Ian wrote: > > > >> I configured a template with regexes for all of the information I want > logged: > >> > >> $template > jsonTemplate,"{%msg:R,ERE,1,BLANK:username=([A-Za-z0-9_-]+)--end:jsonf:msg_username%,%msg:R,ERE,1,BLANK:clientip=([[:digit:]]{1,3}\.[[:digit:]]{1,3}\.[[:digit:]]{1,3}\.[[:digit:]]{1,3})--end:jsonf:msg_clientip%, > ...}" > >> > >> and this logs to a file perfectly. However when I log this same info to > MongoDB nothing is logged. I can log a simple, non-json template to MongoDB > so I know the connection works correctly. In the docs it says regexes don't > work with filtering (I had been using if $app-name == 'myapp' then > action(...)) and thought this was the issue, but even when I use the above > template with the very straightforward: > >> > >> *.* action(type="ommongodb" server="localhost" serverport="27017" > uid="rsyslog" pwd="..." db="..." collection="...") > >> > >> this does not log to the database. I removed the jsonf formatting of > the template fields as well, but still no luck. What should I be doing > differently here? > > > >Remember that the database templates include everything that is sent to > >the database, this includes the "insert into TABLE X" and trailing ";" > >parts of the syntax. > > > >take a look at the example mongodb template and add this extra syntax > >around the part of the template that you have been working with. > > > >David Lang > > > > > > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards
