Hi Radu, I can do this from rsyslog also? I'm using this template to send data:
template(name="es_template" type="subtree" subtree="$!") where the subtree is populated by mmnormalize rules and some manual ones, like: set $!message = $msg; set $!hostname = $hostname; On Tue, Aug 26, 2014 at 5:39 PM, Radu Gheorghe <[email protected]> wrote: > On Tue, Aug 26, 2014 at 2:58 PM, Cristian Falcas <[email protected]> > wrote: > > > Hello, > > > > I tested the branch now, and it seems to work correctly. Meaning that > there > > are no "" messages in errorFiles. I don't know how to force elastic > search > > to reject messages, so I didn't test if in case of error there is also a > > message from rsyslog, > > > > > Hi Cristian, > > Thanks for testing this! It looks like I can't help right now :( > > To make ES reject a message, define a mapping with an integer field, and > try to send a string to that field from rsyslog. For example, make "msg" > integer or something like that. It will cry like a baby. > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
