<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="generator" content="Osso Notes">
<title></title></head>
<body>
<p>
<br>Hi,
<br>
<br>the simplest way right now is the set-tag() rewrite operation, that together with condition() might do the trick.
<br>
<br>I know there should be an easier way, but I'm afraid there isn't.
<br>
<br>I'm thinking about how this should work in the long term, but right now I don't have a clear idea.
<br>
<br>----- Original message -----
<br>> I have a situation where syslog-ng processes a syslog line, users
<br>> paserdb and does lots of work and finally sends the complete object via
<br>> json to an external application. This application does some thinking and
<br>> based on some other data sources needs to send the log message back into
<br>> syslog-ng with a different set of TAGS so that it gets routed through
<br>> syslog-ng to a different destination program.
<br>>
<br>> The problem I am having is that syslog-ng does not use the TAGS in the
<br>> incoming json object. The TAGS get replaced with the TAGS on the
<br>> "source" of the syslog-ng that reads the json object, and augmented with
<br>> any patterndb processing.
<br>>
<br>> Can anyone think of a way to get some arbitrary set of TAGS (possibly in
<br>> a different custom macro) placed into the TAGS macro so that all of  the
<br>> filters on tags can be used.
<br>>
<br>> For example, I could make a patterndb for each individual tag value, and
<br>> invoke each patterndb on the MyTags value. If there is a match then tag
<br>> the message with the TAG. I would need to know all of the TAGS in
<br>> advance and would probably not perform all that well, but it would work.
<br>>
<br>>
<br>> Thanks in advance for any other suggestions.
<br>>
<br>>
<br>> --
<br>> Evan Rempel  <a href="mailto:erempel@uvic.ca">erempel@uvic.ca</a>
<br>> Senior Systems Administrator  250.721.7691
<br>> Data Centre Services, University Systems, University of Victoria
<br>> ______________________________________________________________________________
<br>> Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a>
<br>> Documentation:
<br>> <a href="http://www.balabit.com/support/documentation/?product=syslog-ng">http://www.balabit.com/support/documentation/?product=syslog-ng</a> FAQ:
<br>> <a href="http://www.balabit.com/wiki/syslog-ng-faq">http://www.balabit.com/wiki/syslog-ng-faq</a>
<br>>
<br><br></p>
</body>
</html>