I'm still looking for the example mongodb template you mentioned that
includes the database-level syntax in it; if you have a link I'd appreciate
it. Searching rsyslog.com and the wiki returns results that mostly point
to release announcements; some results do cover MongoDB configuration but
do not show the database-level syntax being used in a template.
I wrapped my previously-mentioned template in MongoDB syntax so it looks
like:
$template
mongoTemplate,"db.myCollection.save({%msg:R,ERE,1,BLANK:clientip=([[:digit:]]{1,3}\.[[:digit:]]{1,3}\.[[:digit:]]{1,3}\.[[:digit:]]{1,3})--end:jsonf:msg_clientip%});"
but this didn't log anything to MongoDB. Neither did simple variations
like:
$template mongoTemplate,"db.myCollection.save({message: %msg%});" or
$template mongoTemplate,"db.myCollection.save({test: \"Testing\"});"
Thanks again,
Ian
________________________________
From: "[email protected]" <[email protected]>
To: Ian <[email protected]>; rsyslog-users <
[email protected]>
Sent: Monday, August 20, 2012 1:39 PM
Subject: Re: [rsyslog] Regex logging to MongoDB
On Mon, 20 Aug 2012, Ian wrote:
I configured a template with regexes for all of the information I want
logged:
$template
jsonTemplate,"{%msg:R,ERE,1,BLANK:username=([A-Za-z0-9_-]+)--end:jsonf:msg_username%,%msg:R,ERE,1,BLANK:clientip=([[:digit:]]{1,3}\.[[:digit:]]{1,3}\.[[:digit:]]{1,3}\.[[:digit:]]{1,3})--end:jsonf:msg_clientip%,
...}"
and this logs to a file perfectly. However when I log this same info to
MongoDB nothing is logged. I can log a simple, non-json template to MongoDB
so I know the connection works correctly. In the docs it says regexes don't
work with filtering (I had been using if $app-name == 'myapp' then
action(...)) and thought this was the issue, but even when I use the above
template with the very straightforward:
*.* action(type="ommongodb" server="localhost" serverport="27017"
uid="rsyslog" pwd="..." db="..." collection="...")
this does not log to the database. I removed the jsonf formatting of
the template fields as well, but still no luck. What should I be doing
differently here?
Remember that the database templates include everything that is sent to
the database, this includes the "insert into TABLE X" and trailing ";"
parts of the syntax.
take a look at the example mongodb template and add this extra syntax
around the part of the template that you have been working with.
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
