On 23/04/2019 20:50, David Lang wrote:
where in the documentation does it say a ruleset can have a parser?
https://www.rsyslog.com/doc/v8-stable/configuration/parser.html
where it gives this example:
ruleset(name="myRuleset"
parser=["rsyslog.lastline","rsyslog.aixforwardedfrom","rsyslog.rfc5424","rsyslog.rfc3164"])
{
... do something here ...
}
That made me think that the list of parsers is an attribute of the ruleset.
Also https://www.rsyslog.com/doc/v8-stable/concepts/multi_ruleset.html
where it says:
"Custom message parsers, used to handle different (and potentially
otherwise-invalid) message formats, can be bound to rulesets."
Also
https://www.rsyslog.com/doc/v8-stable/concepts/messageparser.html#where-are-parser-chains-used
where it says:
"The question is now how many parser chains can be active and how it is
decided which parser chain is used on which message. This is controlled
viarsyslog’s rulesets
<https://www.rsyslog.com/doc/v8-stable/concepts/multi_ruleset.html>. In
short, multiple rulesets can be defined and there always exist at least
one ruleset. A parser chain is bound to a specific ruleset."
But it's hard to find further examples of the ruleset(... parser=...)
syntax.
parsing of the message happens in the input module, before any ruleset
(including the default ruleset)
Then how is the input module configured with the list of parsers to use?
Regards,
Brian.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
