pgillard at thoughtworks
Jan 25, 2012, 2:13 AM
Post #5 of 5
(138 views)
Permalink
|
Thanks for the pointers. I used the debug and found that both programname
and APP-NAME did the job.
I also found this thanks to your pointers:
http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/Deployment_Guide/ch-Viewing_and_Managing_Log_Files.html
That had a useful guide to property based and expression based filters.
In the end I went with the following expression based filter:
if $programname == 'my_app' then @@logs.loggly.com:[port]
On 25 January 2012 09:24, Rainer Gerhards <rgerhards [at] hq> wrote:
>
>
> > -----Original Message-----
> > From: rsyslog-bounces [at] lists [mailto:rsyslog-
> > bounces [at] lists] On Behalf Of Peter Gillard-Moss
> > Sent: Wednesday, January 25, 2012 10:20 AM
> > To: rsyslog-users
> > Subject: Re: [rsyslog] Conditional forwarding on imfiles
> >
> > Thanks for the reply Rainer.
> >
> > I have searched and searched for this (so perhaps it is a RTFM but I'm
> > struggling to find what part).
> >
> > The nearest thing I could find was this:
> > :msg, startswith, "my_app:" @@logs.loggly.com:[port]',
>
> almost ;) It's not msg but rather syslogtag (or tag, don't know out of my
> head).
>
> Quick way to see what is in message: add
> *.* /var/log/debuglog;RSYSLOG_DebugFormat
> The file will tell you all properties used and actual content.
>
> Hth rg
> >
> > Does this look correct?
> >
> > On 24 January 2012 17:50, Rainer Gerhards <rgerhards [at] hq>
> > wrote:
> >
> > > You could check for the tag you have configured; make sure that it is
> > > sufficiently unique.
> > >
> > > rainer
> > >
> > > > -----Original Message-----
> > > > From: rsyslog-bounces [at] lists [mailto:rsyslog-
> > > > bounces [at] lists] On Behalf Of Peter Gillard-Moss
> > > > Sent: Tuesday, January 24, 2012 6:41 PM
> > > > To: rsyslog [at] lists
> > > > Subject: [rsyslog] Conditional forwarding on imfiles
> > > >
> > > > Hello,
> > > >
> > > > I am using loggly to forward messages to. I need to send logs from
> > > > a custom application which uses a bespoke logging format to a
> > > > different location.
> > > >
> > > > I have an imfile config which looks like this:
> > > >
> > > > $ModLoad imfile
> > > > $InputFileName /opt/myapp/log/my_app.log $InputFileTag myapp:
> > > > $InputFileStateFile stat-myapp
> > > > $InputFileSeverity info
> > > > $InputRunFileMonitor
> > > >
> > > > $InputFilePollInterval 10
> > > >
> > > > *.* @@logs.loggly.com:[port]
> > > >
> > > > I only want to forward entries from my_app. How would I go about
> > > > doing this?
> > > >
> > > > Thanks in advance.
> > > > Peter
> > > > _______________________________________________
> > > > rsyslog mailing list
> > > > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > > > http://www.rsyslog.com/professional-services/
> > > _______________________________________________
> > > rsyslog mailing list
> > > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > > http://www.rsyslog.com/professional-services/
> > >
> > _______________________________________________
> > rsyslog mailing list
> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > http://www.rsyslog.com/professional-services/
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
>
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
|
