In my previous messages I said that I have been able to log generically to MongoDB with *.* action(MongoDB info...). I decided to download the newly-released 6.4.0 stable release on the chance code changes might help this. In rsyslog-6.4.0/plugins/ommongodb/README I found the line:
"Note: currently templates are not supported. Ommongodb will pick a default schema and use the message object content for that (templateless)." So that explains why my attempts with templates are failing... Thanks for the replies. Ian >________________________________ > From: "[email protected]" <[email protected]> >To: Ian <[email protected]>; rsyslog-users <[email protected]> >Sent: Tuesday, August 21, 2012 2:29 PM >Subject: Re: [rsyslog] Regex logging to MongoDB > >It's always possible that I'm wrong in how ommongodb works, just because >most database interfaces include the database syntax doesn't guarantee >that this plugin does as well. Can you get any of the examples to >work to log to mongodb? > >Once you get anything working, modifying that template to write other >things should be straightforward. > >David Lang > >On Tue, 21 Aug 2012, Ian wrote: > >> Thanks for the suggestion. Debugging isn't turning up any clues. I've >> yet to find a single example of a template using MongoDB database-level >> syntax. If anyone has a link to or can provide an example of this it >> would be much appreciated. Otherwise I'm going to have to start looking >> for alternatives to rsyslog. >> >> Thanks, >> Ian >> >> >> >> >>> ________________________________ >>> From: Radu Gheorghe <[email protected]> >>> To: rsyslog-users <[email protected]> >>> Sent: Monday, August 20, 2012 10:26 PM >>> Subject: Re: [rsyslog] Regex logging to MongoDB >>> >>> Hi Ian, >>> >>> If you turn rsyslog and/or mongodb to Debug, do you see any clues in the >>> logs? >>> >>> I don't know the answer to your specific question, but this always helped >>> me when I had similar trouble with Elasticsearch. >>> >>> 2012/8/21 Ian <[email protected]> >>> >>>> I'm still looking for the example mongodb template you mentioned that >>>> includes the database-level syntax in it; if you have a link I'd appreciate >>>> it. Searching rsyslog.com and the wiki returns results that mostly point >>>> to release announcements; some results do cover MongoDB configuration but >>>> do not show the database-level syntax being used in a template. >>>> >>>> I wrapped my previously-mentioned template in MongoDB syntax so it looks >>>> like: >>>> $template >>>> mongoTemplate,"db.myCollection.save({%msg:R,ERE,1,BLANK:clientip=([[:digit:]]{1,3}\.[[:digit:]]{1,3}\.[[:digit:]]{1,3}\.[[:digit:]]{1,3})--end:jsonf:msg_clientip%});" >>>> >>>> >>>> but this didn't log anything to MongoDB. Neither did simple variations >>>> like: >>>> $template mongoTemplate,"db.myCollection.save({message: %msg%});" or >>>> >>>> $template mongoTemplate,"db.myCollection.save({test: \"Testing\"});" >>>> >>>> >>>> Thanks again, >>>> Ian >>>> >>>> >>>> >>>> >>>>> ________________________________ >>>>> From: "[email protected]" <[email protected]> >>>>> To: Ian <[email protected]>; rsyslog-users < >>>> [email protected]> >>>>> Sent: Monday, August 20, 2012 1:39 PM >>>>> Subject: Re: [rsyslog] Regex logging to MongoDB >>>>> >>>>> On Mon, 20 Aug 2012, Ian wrote: >>>>> >>>>>> I configured a template with regexes for all of the information I want >>>> logged: >>>>>> >>>>>> $template >>>> jsonTemplate,"{%msg:R,ERE,1,BLANK:username=([A-Za-z0-9_-]+)--end:jsonf:msg_username%,%msg:R,ERE,1,BLANK:clientip=([[:digit:]]{1,3}\.[[:digit:]]{1,3}\.[[:digit:]]{1,3}\.[[:digit:]]{1,3})--end:jsonf:msg_clientip%, >>>> ...}" >>>>>> >>>>>> and this logs to a file perfectly. However when I log this same info to >>>> MongoDB nothing is logged. I can log a simple, non-json template to MongoDB >>>> so I know the connection works correctly. In the docs it says regexes don't >>>> work with filtering (I had been using if $app-name == 'myapp' then >>>> action(...)) and thought this was the issue, but even when I use the above >>>> template with the very straightforward: >>>>>> >>>>>> *.* action(type="ommongodb" server="localhost" serverport="27017" >>>> uid="rsyslog" pwd="..." db="..." collection="...") >>>>>> >>>>>> this does not log to the database. I removed the jsonf formatting of >>>> the template fields as well, but still no luck. What should I be doing >>>> differently here? >>>>> >>>>> Remember that the database templates include everything that is sent to >>>>> the database, this includes the "insert into TABLE X" and trailing ";" >>>>> parts of the syntax. >>>>> >>>>> take a look at the example mongodb template and add this extra syntax >>>>> around the part of the template that you have been working with. >>>>> >>>>> David Lang >>>>> >>>>> >>>>> >>>> _______________________________________________ >>>> rsyslog mailing list >>>> http://lists.adiscon.net/mailman/listinfo/rsyslog >>>> http://www.rsyslog.com/professional-services/ >>>> What's up with rsyslog? Follow https://twitter.com/rgerhards >>>> >>> _______________________________________________ >>> rsyslog mailing list >>> http://lists.adiscon.net/mailman/listinfo/rsyslog >>> http://www.rsyslog.com/professional-services/ >>> What's up with rsyslog? Follow https://twitter.com/rgerhards >>> >>> >>> >> _______________________________________________ >> rsyslog mailing list >> http://lists.adiscon.net/mailman/listinfo/rsyslog >> http://www.rsyslog.com/professional-services/ >> What's up with rsyslog? Follow https://twitter.com/rgerhards >> > > > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards
