Thanks Rainer / David,
Based on Rainer's input I've pivoted to going down the mmexternal path and have
questions based on experimenting with that.
To answer David's "what are you trying to do" question and make things as
simple and concrete as possible I've created a clean example (log entry
generator, rsyslog configuration, mmexternal plugin, etc.) that captures what
I'm trying to do. To avoid pasting a bunch of stuff into these emails I set up
a git repo with the example at:
https://github.com/davidboles/snowflake.git
The README.md explains the elements of that repo. I have the following
questions:
(1) The generated result does not have the { "hostname" : "frodo" } anywhere in
it. The docs say that I can add elements to the JSON elements of the message,
although that sentence is ambiguous as to whether I can do so if I haven't
modified some other element.
(2) If I uncomment the template line (line 20 of build.conf) then syslog
SEGV's. How do I access the jsonmesg content after getting stuff back through
mmexternal?
(3) The field "MUTABLE" has the value "Alpha" in the input to the mmexternal
unit (I can see it in /tmp/rewriter.trace entries). What JSON should my
rewriter.py emit to cause that to be rewritten to "Beta"?
Thanks,
David Boles
________________________________________
From: [email protected] [[email protected]] on
behalf of Rainer Gerhards [[email protected]]
Sent: Friday, May 22, 2015 5:05 PM
To: rsyslog-users
Subject: Re: [rsyslog] Unable to use foreach
External plugin interface:
https://github.com/rsyslog/rsyslog/blob/master/plugins/external/INTERFACE.md
Overview :
https://github.com/rsyslog/rsyslog/blob/master/plugins/external/README.md
Sent from phone, thus brief.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
