<div dir="ltr">Thanks <span style="color:rgb(0,0,0);font-size:12.8px">Bazsi!</span></div><div class="gmail_extra"><br clear="all"><div><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr">--<div>Jorge Pereira</div></div></div></div>
<br><div class="gmail_quote">On Wed, Mar 22, 2017 at 1:57 AM, Scheidler, Balázs <span dir="ltr"><<a href="mailto:balazs.scheidler@balabit.com" target="_blank">balazs.scheidler@balabit.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="auto">In template functions you can't and should not do that. There's a python parser they was recently merged where you can change values.<div dir="auto"><br></div><div dir="auto">But you'll need the latest master for that.</div><div dir="auto"><br></div><div dir="auto">Bazsi</div></div><div class="HOEnZb"><div class="h5"><div class="gmail_extra"><br><div class="gmail_quote">On Mar 22, 2017 05:45, "Jorge Pereira" <<a href="mailto:jpereiran@gmail.com" target="_blank">jpereiran@gmail.com</a>> wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">hi Bazsi,<div><br></div><div>yes! I saw the code and looks to be easy.</div><div><br></div><div>btw, is it possible to rewrite the $MESSAGE var using python? I have tried the below code without success.</div><div><br></div><div><div>python {</div><div>import socket</div><div><br></div><div>def resolve_host(logmsg, hostname):</div><div>    try:</div><div>        logmsg["MESSAGE"] = "My caipirinha!"</div><div>        return socket.gethostbyaddr(hostname)<wbr>[0]</div><div>    except (socket.herror, socket.error):</div><div>        return 'unknown'</div><div><br></div><div>};</div><div><br></div><div>destination d_python {</div><div>    file("/tmp/test.txt" template("@@@ ${ISODATE} # $(python resolve_host 200.221.2.44) # ${MESSAGE} \n"));</div><div>};</div></div><div><div><br></div></div></div><div class="gmail_extra"><br clear="all"><div><div class="m_2804824020808405008m_-7916691850166370659gmail_signature" data-smartmail="gmail_signature"><div dir="ltr">--<div>Jorge Pereira</div></div></div></div>
<br><div class="gmail_quote">On Tue, Mar 21, 2017 at 2:27 AM, Scheidler, Balázs <span dir="ltr"><<a href="mailto:balazs.scheidler@balabit.com" target="_blank">balazs.scheidler@balabit.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div><div><div><div><div><div>Hi,<br><br></div>No there's not, you can include one using the syslog-ng @include mechanism, but in that case the python block needs to be part of that file. And yes, you can achieve the same using the confgen module as well, but that would execute an external script.<br><br></div>It probably wouldn't be very difficult to implement this syntax:<br><br></div>python "python-script.py";<br><br></div>Which would execute that file instead of the python block (look at python-main.c and its evaluate_global_code function), but there's no such functionality now.<br><br></div>Cheers,<br></div>Bazsi<span class="m_2804824020808405008m_-7916691850166370659HOEnZb"><font color="#888888"><br><br></font></span></div><div class="gmail_extra"><span class="m_2804824020808405008m_-7916691850166370659HOEnZb"><font color="#888888"><br clear="all"><div><div class="m_2804824020808405008m_-7916691850166370659m_-8010242052173770865gmail_signature" data-smartmail="gmail_signature"><div dir="ltr">-- <br>Bazsi<br></div></div></div></font></span><div><div class="m_2804824020808405008m_-7916691850166370659h5">
<br><div class="gmail_quote">On Mon, Mar 20, 2017 at 5:34 PM, Jorge Pereira <span dir="ltr"><<a href="mailto:jpereiran@gmail.com" target="_blank">jpereiran@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Hi Balázs,<div><br></div><div>Thanks for the answer. But, My question is: It is possible to include a external python script.</div><div><br></div><div>e.g:<br><div class="gmail_extra"><br></div><div class="gmail_extra"><div dir="auto">$ cat foobar.conf:</div><div dir="auto"><br></div><div dir="auto">python {</div><div>   @include "caipirinha.py"</div><div dir="auto">}</div><div dir="auto"><br></div><div dir="auto"><div dir="auto">template-function foobar "$(python foobar)"</div><div><br></div></div><div>$ cat caipirinha.py</div><div>from foobar import foobar_template_function<br></div><div># my python class/code is separated</div><div>...........</div><div dir="auto"><br></div><div dir="auto">$</div><div dir="auto"><br></div><div>got it? maybe using the "confgen" module?</div><div><div class="m_2804824020808405008m_-7916691850166370659m_-8010242052173770865m_7367423564698332720gmail_signature"><div dir="ltr">--<div>Jorge Pereira</div></div></div></div><div><div class="m_2804824020808405008m_-7916691850166370659m_-8010242052173770865h5">
<br><div class="gmail_quote">On Mon, Mar 20, 2017 at 2:35 AM, Scheidler, Balázs <span dir="ltr"><<a href="mailto:balazs.scheidler@balabit.com" target="_blank">balazs.scheidler@balabit.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="auto">Hi,<div dir="auto"><br></div><div dir="auto">The example Python code should be unindented, or you see a different error?</div><div dir="auto"><br></div><div dir="auto">Also, you can always import code in the python block.</div><div dir="auto"><br></div><div dir="auto">With destinations you can specify a path to a python file, so the python block is not needed. But with template functions I've figured the $(python) call would be too crowded if we were passing explicit filename parameters.</div><div dir="auto"><br></div><div dir="auto">But you can encapsulate the python code as well as a wrapper to the python code into a separate file.</div><div dir="auto"><br></div><div dir="auto">Foobar.conf:</div><div dir="auto"><br></div><div dir="auto">python {</div><div dir="auto"><br></div><div dir="auto">from foobar import foobar_template_function</div><div dir="auto"><br></div><div dir="auto">}</div><div dir="auto"><br></div><div dir="auto">template-function foobar "$(python foobar)"</div><div dir="auto"><br></div><div dir="auto">----------</div><div dir="auto"><br></div><div dir="auto">Then you can use:</div><div dir="auto"><br></div><div dir="auto">@include "Foobar.conf"</div><div dir="auto"><br></div><div dir="auto">...</div><div dir="auto">template("$(foobar)");</div><div dir="auto">...</div><div dir="auto"><br></div><div dir="auto">Unfortunately then template function declarations cant take parameters yet from the callsite, which may be a serious limitation in your use-case. But with a conceot above you can completely hide implementation details your actual config.</div></div><div class="gmail_extra"><br><div class="gmail_quote"><div><div class="m_2804824020808405008m_-7916691850166370659m_-8010242052173770865m_7367423564698332720gmail-h5">On Mar 20, 2017 03:53, "Jorge Pereira" <<a href="mailto:jpereiran@gmail.com" target="_blank">jpereiran@gmail.com</a>> wrote:<br type="attribution"></div></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div><div class="m_2804824020808405008m_-7916691850166370659m_-8010242052173770865m_7367423564698332720gmail-h5"><div dir="ltr">Well, based on this[1] document. We should use the <i>python {}</i> statement. But, I would like to keep my python script externally in a separated file and do something like.<div><br></div><div>python filter_001 {</div><div>   /my/script/python001.py</div><div>}<br><div><br></div><div>log {</div><div>   ....</div><div>   filter(filter_001);</div><div>   ....</div><div>};</div><div><br></div><div>p.s: Btw, this sample <a href="https://www.balabit.com/documents/syslog-ng-ose-3.7-guides/en/syslog-ng-ose-guide-admin/html-single/index.html#example-python-template-functions" target="_blank">https://www.balabit.com<wbr>/documents/syslog-ng-ose-3.7-g<wbr>uides/en/syslog-ng-ose-guide-a<wbr>dmin/html-single/index.html#ex<wbr>ample-python-template-function<wbr>s</a> don't work in the syslog-ng 3.9.1</div><div><br></div><div>[1] <a href="https://www.balabit.com/sites/default/files/documents/syslog-ng-ose-3.7-guides/en/syslog-ng-ose-v3.7-guide-admin/html-single/index.html#example-python-template-functions" target="_blank">https://www.balabit.com/sites/<wbr>default/files/documents/syslog<wbr>-ng-ose-3.7-guides/en/syslog-n<wbr>g-ose-v3.7-guide-admin/html-si<wbr>ngle/index.html#example-python<wbr>-template-functions</a><br clear="all"><div><div class="m_2804824020808405008m_-7916691850166370659m_-8010242052173770865m_7367423564698332720gmail-m_3347947724770204887m_7508179016639834892gmail-m_-2478784884897075564gmail_signature"><div dir="ltr">--<div>Jorge Pereira</div></div></div></div>
</div></div></div>
<br></div></div>______________________________<wbr>______________________________<wbr>__________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/mailm<wbr>an/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/support<wbr>/documentation/?product=syslog<wbr>-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/sy<wbr>slog-ng-faq</a><br>
<br>
<br></blockquote></div></div>
<br>______________________________<wbr>______________________________<wbr>__________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/mailm<wbr>an/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/support<wbr>/documentation/?product=syslog<wbr>-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/sy<wbr>slog-ng-faq</a><br>
<br>
<br></blockquote></div><br></div></div></div></div></div>
<br>______________________________<wbr>______________________________<wbr>__________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/mailm<wbr>an/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/support<wbr>/documentation/?product=syslog<wbr>-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/sy<wbr>slog-ng-faq</a><br>
<br>
<br></blockquote></div><br></div></div></div>
<br>______________________________<wbr>______________________________<wbr>__________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/mailm<wbr>an/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/support<wbr>/documentation/?product=syslog<wbr>-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/sy<wbr>slog-ng-faq</a><br>
<br>
<br></blockquote></div><br></div>
<br>______________________________<wbr>______________________________<wbr>__________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/mailm<wbr>an/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/support<wbr>/documentation/?product=<wbr>syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/sy<wbr>slog-ng-faq</a><br>
<br>
<br></blockquote></div></div>
</div></div><br>______________________________<wbr>______________________________<wbr>__________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/<wbr>mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/<wbr>support/documentation/?<wbr>product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/<wbr>syslog-ng-faq</a><br>
<br>
<br></blockquote></div><br></div>