<div dir="ltr"><div><div><div><div><div>Rereading my answer I may not have been completely clear. Make sure that your parser and the program destination are actually connected on the same log path.<br><br></div>E.g.<br><br>
log { source(...); parser(p_apache); destination(d_program); };<br><br></div>If your apache parser is on an independent log path, it won't work:<br><br></div>log { source(...); parser(p_apache); destination(...); };<br>
</div>log { source(...); destination(d_program); };<br><br>e.g. independent log paths will not inherit from the values set by the earlier log statements. changes are only propagated through the same pipeline.<br><br></div>
Hope this helps.<br><br></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Fri, Mar 7, 2014 at 7:32 AM, Balazs Scheidler <span dir="ltr"><<a href="mailto:bazsi77@gmail.com" target="_blank">bazsi77@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><p dir="ltr">What do you get in your script? Empty fields?</p>
<p dir="ltr">The program destination has to be on a direct log path subsequent to the parser.</p>
<div class="gmail_quote"><div><div class="h5">On Mar 4, 2014 7:27 PM, "Justin B" <<a href="mailto:justinkala@gmail.com" target="_blank">justinkala@gmail.com</a>> wrote:<br type="attribution"></div></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div><div class="h5">
<div><br clear="all">Hello</div>
<div> </div>
<div>On My Apache logs I applied csv_parser() and defined the Macros.</div>
<div> parser p_apache {<br>csv-parser(columns("apache.ETSTAMP", "apache.TYPE", "apache.EHOSTNAME","apache.ESOURCE", "apache.EOUTCOME", "apache.EMSG","apache.EUSERID")<br>
delimiters("|") );<br>};<br></div>
<div> </div>
<div>I want to launch a script whenever the UDP messages are in.So I defined the</div>
<div> </div>
<div> destination d_mesg (program("/tmp/test.sh" template("|${apache.ETSTAMP}|${apache.TYPE}|${apache.EHOSTNAME}|${apache.ESOURCE}|${apache.EOUTCOME}|${apache.EMSG}|${apache.EUSERID}\n")); };</div>
<div> </div>
<div>script is working fine with other destination drivers. Please help<br>-- <br>Kale</div>
<br></div></div>______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
<br></blockquote></div>
</blockquote></div><br><br clear="all"><br>-- <br>Bazsi
</div>