<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7232.39">
<TITLE>Splitting a single source to multiple mysql tables</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/rtf format -->
<P><FONT SIZE=2 FACE="Arial">Hiya,</FONT>
<BR><FONT SIZE=2 FACE="Arial">Here's what I have, why doesn't it work?</FONT>
</P>
<BR>
<P><FONT SIZE=2 FACE="Arial">destination d_mysql { pipe("/var/log/mysql.pipe" template("INSERT INTO logs</FONT>
<BR><FONT SIZE=2 FACE="Arial"> (host, facility, priority, level, datetime, msg)</FONT>
<BR><FONT SIZE=2 FACE="Arial"> VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC','$MSG' );\n") template-esc</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">destination d_host { pipe("/var/log/mysql.pipe" template("INSERT INTO host</FONT>
<BR><FONT SIZE=2 FACE="Arial"> (host) </FONT>
<BR><FONT SIZE=2 FACE="Arial">VALUES ( '$HOST' ) ON DUPLICATE KEY UPDATE count=count+1;\n") template-escape(yes)); };</FONT>
<BR><FONT SIZE=2 FACE="Arial"> </FONT>
<BR><FONT SIZE=2 FACE="Arial">destination d_mysql_facility { pipe("/var/log/mysql.pipe" template("INSERT IGNORE INTO facility</FONT>
<BR><FONT SIZE=2 FACE="Arial"> (facility) </FONT>
<BR><FONT SIZE=2 FACE="Arial">VALUES ( '$FACILITY' );\n") template-escape(yes)); };</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial"># This doesn't work</FONT>
<BR><FONT SIZE=2 FACE="Arial">#log { source(net); destination(d_mysql); destination(d_host); destination(d_mysql_facility); }; </FONT>
</P>
<P><FONT SIZE=2 FACE="Arial"># This works</FONT>
<BR><FONT SIZE=2 FACE="Arial"> log { source(net); destination(d_mysql); };</FONT>
</P>
<BR>
</BODY>
</HTML>