Hi
Considering our imrelp module receives a lot of messages from different
applications/hosts (with different TAGs), what would be the best way to
split/forward each message to proper ruleset/parser?
Should I use /_if/_?
Does
http://www.rsyslog.com/doc/v8-stable/configuration/modules/mmnormalize.html
have something to "process only specific messages" ?
Quoting https://github.com/rsyslog/rsyslog/issues/625#issuecomment-262286487
> If you can combine the programname with the message and include the
programname in your rules (prefix works wonders here), liblognorm is
extremely efficient in only using the relevant rules.
I understand it's just having TAG as part of rule, isnt it?
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
