<html><head></head><body>Hi,<br>
<br>
Are multiple channel{} commands processed in parallel or sequentially?<br>
<br>
Kr,<br>
<br>
James<br><br><div class="gmail_quote">On 9 May 2017 07:20:05 BST, "Scheidler, Balázs" <balazs.scheidler@balabit.com> wrote:<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<div dir="auto">This is possible, but with quite ugly syntax. I always wanted to add some syntactic sugar, but never got around to do it.<div dir="auto"><br /></div><div dir="auto">It looks like this:</div><div dir="auto"><br /></div><div dir="auto">junction {</div><div dir="auto"> channel {</div><div dir="auto"> # if, with conditions specified as filters</div><div dir="auto"> filter { whatever... };</div><div dir="auto"> destination { whatever };</div><div dir="auto"> flags(final);</div><div dir="auto"> };</div><div dir="auto"> channel {</div><div dir="auto"> # else, you can add filters as well</div><div dir="auto"> destination { something else };</div><div dir="auto"> flags(final);</div><div dir="auto"> };</div><div dir="auto">};</div><div dir="auto"><br /></div><div dir="auto">The key parts:</div><div dir="auto">* This can be embedded to any log statement as it is</div><div dir="auto">* It uses inline filters and destinations, but you can use other definitions by using simple parens instead of braces.</div><div dir="auto">* flags final which causes processing to be stopped at the first match. Without that, you'd be duplicating messages, if the conditions overlap.</div><div dir="auto">* You can add any number of channels, you are not limited to one if/else construct. It is more like a filter based switch with multple potential branches.</div><div dir="auto"><br /></div><div dir="auto">Hope this helps,</div><div dir="auto"><br /></div></div><div class="gmail_extra"><br /><div class="gmail_quote">On May 9, 2017 01:03, "Jorge Pereira" <<a href="mailto:jpereiran@gmail.com">jpereiran@gmail.com</a>> wrote:<br type="attribution" /><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Ops! The documentation explaining only to use with templates.<div><br /></div><div>Basically, I am looking for how to do the below pseudo-code.</div><div><br /></div><div><div> destination {</div><div> if ($R_MIN >= 0 && $R_MIN < 30)</div><div> file("/path/file_00m-15m.log")<wbr />;</div><div> else</div><div> file("/path/file_30m-60m.log")<wbr />;</div><div> endif() </div><div> };</div></div><div><br /></div><div>p.s: I need to save the logs in chunks of 30 minutes being 00m-30m & 31m-60m</div></div><div class="gmail_extra"><br clear="all" /><div><div class="m_1448828263015663302gmail_signature" data-smartmail="gmail_signature"><div dir="ltr">--<div>Jorge Pereira</div></div></div></div>
<br /><div class="gmail_quote">On Mon, May 8, 2017 at 7:52 PM, Jorge Pereira <span dir="ltr"><<a href="mailto:jpereiran@gmail.com" target="_blank">jpereiran@gmail.com</a>></span> wrote:<br /><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">never mind, I found it.<div><br /></div><div><a href="https://www.balabit.com/documents/syslog-ng-ose-latest-guides/en/syslog-ng-ose-guide-admin/html/reference-template-functions.html" target="_blank">https://www.balabit.com/docume<wbr />nts/syslog-ng-ose-latest-<wbr />guides/en/syslog-ng-ose-guide-<wbr />admin/html/reference-template-<wbr />functions.html</a><br /></div></div><div class="gmail_extra"><br clear="all" /><div><div class="m_1448828263015663302m_-8396163469111891983gmail_signature" data-smartmail="gmail_signature"><div dir="ltr">--<div>Jorge Pereira</div></div></div></div><div><div class="m_1448828263015663302h5">
<br /><div class="gmail_quote">On Mon, May 8, 2017 at 7:46 PM, Jorge Pereira <span dir="ltr"><<a href="mailto:jpereiran@gmail.com" target="_blank">jpereiran@gmail.com</a>></span> wrote:<br /><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">hi team,<div>is it possible to use if() ... else statements on syslog-ng 3.7? I am trying to do something like.</div><div><br /></div><div>if ($value >= X)</div><div> ......</div><div>else</div><div> ......<br clear="all" /><div><div class="m_1448828263015663302m_-8396163469111891983m_-8682067114702254480gmail_signature"><div dir="ltr">--<div>Jorge Pereira</div></div></div></div>
</div></div>
</blockquote></div><br /></div></div></div>
</blockquote></div><br /></div>
<br />______________________________<wbr />______________________________<wbr />__________________<br />
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/<wbr />mailman/listinfo/syslog-ng</a><br />
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/<wbr />support/documentation/?<wbr />product=syslog-ng</a><br />
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/<wbr />syslog-ng-faq</a><br />
<br />
<br /></blockquote></div></div>
</blockquote></div><br>
-- <br>
Sent from my Android device with K-9 Mail. Please excuse my brevity.</body></html>