Re: [rsyslog] Back to work with relp -> mmjsonparse -> mmnormalize -> file -> elastic

2016-12-14 Thread mostolog--- via rsyslog
El 14/12/16 a las 10:53, Pascal Withopf escribió: the line on its own can't function because you first need to declare and set myhostname as a variable. Could you give me the whole rsyslog.conf file, so I can see the context 2016-12-14 10:34 GMT+01:00 mostolog--- via rsyslog < rsyslog@list

Re: [rsyslog] liblognorm vs grok

2016-12-14 Thread mostolog--- via rsyslog
El 07/12/16 a las 21:00, Rainer Gerhards escribió: I'm getting /invalid field type 'alternative'/ when using it. Any ideas? rule=test:%[ {"type":"alternative","parser":[ {"type":"literal","text":"-"}, {"type":"word","name":"identd"} ]} ]% no idea Did you Set Version=2

[rsyslog] global queue configuration?

2016-12-14 Thread mostolog--- via rsyslog
Hi Queue documentation improvements are on my TODO list for next year. Until then, we'll have to ask here in order to properly know how they work. Would a configuration like: global( queue.filename="rsyslog.qi" queue.maxdiskspace="1G" queue.SaveOnShutdown="on"

Re: [rsyslog] Back to work with relp -> mmjsonparse -> mmnormalize -> file -> elastic

2016-12-14 Thread mostolog--- via rsyslog
line 33: set $!data!myhost=$myhostname; El 14/12/16 a las 10:33, Pascal Withopf escribió: Hi, the error message shows that the error is around line 33. Could you send me the lines 30-35 of the rsyslog.conf file please. Regards 2016-12-14 10:02 GMT+01:00 mostolog--- via rsyslog < rsys

[rsyslog] Back to work with relp -> mmjsonparse -> mmnormalize -> file -> elastic

2016-12-14 Thread mostolog--- via rsyslog
Hi We have found several issues with our relp-file-elastic relay config. Hope you can help us. template(name="json" type="string" string="%$!data%\n") ruleset(name="to-index"){ set $!data=$msg; set $!data!dummy_host=$hostname; set $!data!foo="foo";

<    1   2