the line on its own can't function because you first need to declare and
set myhostname as a variable.
Could you give me the whole rsyslog.conf file, so I can see the context
2016-12-14 10:34 GMT+01:00 mostolog--- via rsyslog <
rsyslog@lists.adiscon.com>:
> line 33: set $!data!myhost=$myhostname;
>
>
> El 14/12/16 a las 10:33, Pascal Withopf escribió:
>
> Hi,
>>
>> the error message shows that the error is around line 33.
>>
>> Could you send me the lines 30-35 of the rsyslog.conf file please.
>>
>> Regards
>>
>> 2016-12-14 10:02 GMT+01:00 mostolog--- via rsyslog <
>> rsyslog@lists.adiscon.com>:
>>
>> Hi
>>>
>>> We have found several issues with our relp-file-elastic relay config.
>>> Hope
>>> you can help us.
>>>
>>> template(name="json" type="string" string="%$!data%\n")
>>>
>>> ruleset(name="to-index"){
>>> set $!data=$msg;
>>> set $!data!dummy_host=$hostname;
>>> set $!data!foo="foo";
>>> action(type="omfile" template="json"...)
>>> }
>>>
>>> Doesn't seem to add myhost/foo to file:
>>>
>>> { "app": "app1", "file": "\/logs\/apps\/app.log", "group":
>>> "mygroup", "msg": "redacted" }
>>>
>>> Also adding "set $!data!myhost=$myhostname;" to the config above, shows
>>> the following error message:
>>>
>>> ...
>>> Shifting token VAR ()
>>> Entering state 42
>>> Reducing stack by rule 69 (line 222):
>>> $1 = token VAR ()
>>> 4886.851403365:main thread : PROP_INVALID for name 'myhostname'
>>> 4886.851406264:main thread : Called LogMsg, msg: error during
>>> parsing file /etc/rsyslog.conf, on or before line 33: invalid
>>> property 'myhostname'
>>> 4886.851435156:main thread : rsyslog/glbl: using '127.0.0.1' as
>>> localhost IP
>>> rsyslogd: error during parsing file /etc/rsyslog.conf, on or before
>>> line 33: invalid property 'myhostname' [v8.23.0 try
>>> http://www.rsyslog.com/e/2207 ]
>>> -> $$ = nterm expr ()
>>> ...
>>>
>>> Regards
>>>
>>> _______________________________________________
>>> rsyslog mailing list
>>> http://lists.adiscon.net/mailman/listinfo/rsyslog
>>> http://www.rsyslog.com/professional-services/
>>> What's up with rsyslog? Follow https://twitter.com/rgerhards
>>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
>>> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
>>> DON'T LIKE THAT.
>>>
>>> _______________________________________________
>> rsyslog mailing list
>> http://lists.adiscon.net/mailman/listinfo/rsyslog
>> http://www.rsyslog.com/professional-services/
>> What's up with rsyslog? Follow https://twitter.com/rgerhards
>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
>> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
>> DON'T LIKE THAT.
>>
>
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
> DON'T LIKE THAT.
>
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
