you would have to use a exec_template call to extract the hour from the
timestamp into a variable and then test against that.
be aware that the timestamp in the message should not be considered reliable,
it's only as good as the system sending the message.
David Lang
On Tue, 26 Jan 2016, Muhammad Asif wrote:
Date: Tue, 26 Jan 2016 11:38:29 +0500
From: Muhammad Asif <[email protected]>
Reply-To: rsyslog-users <[email protected]>
To: rsyslog-users <[email protected]>
Subject: Re: [rsyslog] time-based filters
But $hour is not part of message. What if i want to apply filter on message
timestamp. How can i set range of time.
Thanks
On Tue, Jan 26, 2016 at 1:34 AM, David Lang <[email protected]> wrote:
On Mon, 25 Jan 2016, Muhammad Asif wrote:
Hi Geeks,
I happened to use a specific filter which is time based.
For Instances i only want to forward logs from 9:00 AM to 5:00 PM to
fluentd and after this time all logs should send to some other
destination.
how can i achieve my goal.
There are properties available for this sort of thing, look at $hour and
setup an if statement to check against it.
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
