you define it outside of the ruleset! So it is only executed when the default ruleset is executed. Move it into the ruleset. That's exactly why I needed the full config ;-)
Rainer El mar., 2 jul. 2019 a las 14:20, Naoum, A. (Alexandros) (<[email protected]>) escribió: > > > set $!sourcetype = "syslog_checkpoint_ids_test"; > template(name="DynIPFile" type="string" > string="/var/log/logs/syslog_checkpoint_ids/%FROMHOST-IP%/%FROMHOST-IP%.log") > template(name="DynIPFile_test" type="string" > string="/var/log/logs/%$!sourcetype%/%FROMHOST-IP%/%FROMHOST-IP%.log") > ruleset(name="syslog_checkpoint_ids" > queue.type="Direct" > queue.timeoutenqueue="0") > { > if $fromhost-ip == [ > "15.112.10.6", > "15.112.10.5", > "15.112.10.4", > ] > then { > action(name="action_syslog_checkpoint" > type="omfile" > DynaFile="DynIPFile") > action(name="action_syslog_checkpoint2" > type="omfile" > DynaFile="DynIPFile_test") > > stop > } > } > > > Regards, > Alexandros > > -----Original Message----- > From: Rainer Gerhards <[email protected]> > Sent: Tuesday, July 2, 2019 2:16 PM > To: Naoum, A. (Alexandros) <[email protected]> > Cc: rsyslog-users <[email protected]> > Subject: Re: [rsyslog] ruleset name as variable > > full config pls > > El mar., 2 jul. 2019 a las 14:13, Naoum, A. (Alexandros) > (<[email protected]>) escribió: > > > > > > > > That sound better but I'm not sure if I done it correct because doesn't > > work. > > > > I put this line before the ruleset definition: > > > > set $!sourcetype = "syslog_checkpoint_test"; > > > > I have a template: > > > > template(name="DynIPFile_test" type="string" > > string="/var/log/logs/%$!sourcetype%/%FROMHOST-IP%/%FROMHOST-IP%.log") > > > > In the action I have this: > > > > action(name="action_syslog_checkpoint2" > > type="omfile" > > DynaFile="DynIPFile_test") > > > > Regards, > > Alexandros > > > > -----Original Message----- > > From: Rainer Gerhards <[email protected]> > > Sent: Tuesday, July 2, 2019 1:18 PM > > To: Naoum, A. (Alexandros) <[email protected]> > > Cc: rsyslog-users <[email protected]> > > Subject: Re: [rsyslog] ruleset name as variable > > > > El mar., 2 jul. 2019 a las 13:15, Naoum, A. (Alexandros) > > (<[email protected]>) escribió: > > > > > > > > > Thank you for the reply. > > > > > > It is a good way but in my scenario... probably will not provide what I > > > want to get. > > > I want to reuse this variable as part of the file name on omfile module > > > in multiple rulesets (different sources in each). > > > > variables are NOT local to rulesets. If you do not need a stack, you can > > just use > > > > set $.rsname="name"; > > and use that in the template. That's it. > > > > Rainer > > > > > > So instead of having multiple templates with static parts/names I want to > > > use one template that will get a part of the file name from the ruleset > > > (or from the actual .conf file). > > > > > > > > This message (including any attachments) may contain confidential > > information. It is intended for use by the recipient only. Any > > dissemination, copying or distribution to third parties without the express > > consent of the sender is strictly prohibited. If you have received this > > message in error, please delete it immediately and notify the sender. Thank > > you for your collaboration. > This message (including any attachments) may contain confidential > information. It is intended for use by the recipient only. Any dissemination, > copying or distribution to third parties without the express consent of the > sender is strictly prohibited. If you have received this message in error, > please delete it immediately and notify the sender. Thank you for your > collaboration. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
