<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7232.39">
<TITLE>Splitting a single source to multiple mysql tables</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/rtf format -->

<P><FONT SIZE=2 FACE="Arial">Hiya,</FONT>

<BR><FONT SIZE=2 FACE="Arial">Here's what I have, why doesn't it work?</FONT>
</P>
<BR>

<P><FONT SIZE=2 FACE="Arial">destination d_mysql { pipe(&quot;/var/log/mysql.pipe&quot; template(&quot;INSERT INTO logs</FONT>

<BR><FONT SIZE=2 FACE="Arial">&nbsp;(host, facility, priority, level, datetime, msg)</FONT>

<BR><FONT SIZE=2 FACE="Arial">&nbsp;VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC','$MSG' );\n&quot;) template-esc</FONT>
</P>

<P><FONT SIZE=2 FACE="Arial">destination d_host { pipe(&quot;/var/log/mysql.pipe&quot; template(&quot;INSERT INTO host</FONT>

<BR><FONT SIZE=2 FACE="Arial">&nbsp;(host) </FONT>

<BR><FONT SIZE=2 FACE="Arial">VALUES ( '$HOST' ) ON DUPLICATE KEY UPDATE count=count+1;\n&quot;) template-escape(yes)); };</FONT>

<BR><FONT SIZE=2 FACE="Arial">&nbsp;</FONT>

<BR><FONT SIZE=2 FACE="Arial">destination d_mysql_facility { pipe(&quot;/var/log/mysql.pipe&quot; template(&quot;INSERT IGNORE INTO facility</FONT>

<BR><FONT SIZE=2 FACE="Arial">&nbsp;(facility) </FONT>

<BR><FONT SIZE=2 FACE="Arial">VALUES ( '$FACILITY' );\n&quot;) template-escape(yes)); };</FONT>
</P>

<P><FONT SIZE=2 FACE="Arial"># This doesn't work</FONT>

<BR><FONT SIZE=2 FACE="Arial">#log { source(net); destination(d_mysql); destination(d_host); destination(d_mysql_facility); }; </FONT>
</P>

<P><FONT SIZE=2 FACE="Arial"># This works</FONT>

<BR><FONT SIZE=2 FACE="Arial">&nbsp;log { source(net); destination(d_mysql); };</FONT>
</P>
<BR>

</BODY>
</HTML>