<div dir="ltr"><div dir="ltr">Hello,<div><br></div><div>In short: only messages can have *variables*.</div><div><br></div><div>Approach #1</div><div>Let's imagine that for example a *logpath* can have variable. Create the following construct:</div><div><br></div><div>log {</div><div> var("location", "space");</div><div> var("app", "sputnik-1");</div><div>};</div><div><br></div><div>Also do it in a way that those variables scope and lifetime are limited to the that *logpath*. (Which is just an arbitrary choose, but also somehow makes sense at first glance.)</div><div><br></div><div>Your configuration would be as follows: </div><div><br></div><div><div>log {</div><div> source(s_local);</div><div><br></div><div> if (message('a')) {</div><div> var("app", "foo");</div><div> var("location" "bar");</div><div> }</div><div> elif (message('b')) {</div><div> var("app", "foob");</div><div> var("location" "barb");</div><div> }</div><div> else {</div><div> var("app", "default");</div><div> var("location" "default");</div><div> };</div><div><br></div><div> destination {</div><div> file("/dev/stdout" template("$app $location\n"));</div><div> };</div><div>};</div></div><div><br></div><div>The *if-else* actually just a *logpath* in the background - can be rewritten so it became a *log*, so our scope would still apply.</div><div><br></div><div>When the message reaches the *destination* it cannot see the *variable* as neither its lifetime and scope allows it.</div><div><br></div><div>This approach won't solve this issue.</div><div><br class="gmail-Apple-interchange-newline">Approach #2<br></div><div><br></div><div>The same as above but let's patch the lifetime/scope issue. Let's increase both of them to be available from parent (global can be done, but won't change much).</div><div><div>log {<br class="gmail-Apple-interchange-newline">log {</div><div> var("location", "space");</div><div> var("app", "sputnik-1");</div><div>};</div></div><div> #location works here</div><div>};</div><div>#but not here</div><div><br></div><div>In this case the variable collide with each other, there is no useful merge strategy (imho).</div><div><br></div><div><br></div><div>From this it seems that even if *logpath* could have variable support, it would not solve your issue. At least I do not see a proper way to do it on paper.</div><div><br></div><div>Also I think from the above it feels like it is actually a property of the message nor the pipeline it traverse.</div><div><br></div><div><br></div><div>If you have an idea that solves the above issue I would be happy to hear it.</div><div><br></div><div><br></div><div><br></div><div>--</div><div>Kokan</div></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, Mar 25, 2019 at 2:07 PM Faine, Mark R. (MSFC-IS40)[NICS] <<a href="mailto:mark.faine@nasa.gov">mark.faine@nasa.gov</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div lang="EN-US">
<div class="gmail-m_8572965254503653930WordSection1">
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">Thank you both, this is very helpful. I can use this. Is it only possible to set variables by adding to the message? Can variables exist outside of the message?<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">-Mark<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><b><span style="font-size:11pt;font-family:Calibri,sans-serif">From:</span></b><span style="font-size:11pt;font-family:Calibri,sans-serif"> syslog-ng <<a href="mailto:syslog-ng-bounces@lists.balabit.hu" target="_blank">syslog-ng-bounces@lists.balabit.hu</a>>
<b>On Behalf Of </b>Péter, Kókai<br>
<b>Sent:</b> Saturday, March 23, 2019 4:34 AM<br>
<b>To:</b> Syslog-ng users' and developers' mailing list <<a href="mailto:syslog-ng@lists.balabit.hu" target="_blank">syslog-ng@lists.balabit.hu</a>><br>
<b>Subject:</b> Re: [syslog-ng] Setting and using variables<u></u><u></u></span></p>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<p class="MsoNormal">Hello,<u></u><u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">You could use *rewrite* rule to add nv-pair to each message:<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<div>
<p class="MsoNormal">log {<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> source(s_local);<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal"> if (message('a')) {<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> rewrite {<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> set("foo" value("app"));<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> set("bar" value("location"));<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> };<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> }<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> elif (message('b')) {<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> rewrite {<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> set("foob" value("app"));<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> set("barb" value("location"));<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> };<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> }<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> else {<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> rewrite {<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> set("default" value("app"));<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> set("default" value("location"));<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> };<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> };<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal"> destination {<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> file("/dev/stdout" template("$app $location\n"));<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> };<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">};<u></u><u></u></p>
</div>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Something like this.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">--<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">Kokan<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<p class="MsoNormal">On Fri, Mar 22, 2019 at 2:37 PM Faine, Mark R. (MSFC-IS40)[NICS] <<a href="mailto:mark.faine@nasa.gov" target="_blank">mark.faine@nasa.gov</a>> wrote:<u></u><u></u></p>
</div>
<blockquote style="border-top:none;border-right:none;border-bottom:none;border-left:1pt solid rgb(204,204,204);padding:0in 0in 0in 6pt;margin-left:4.8pt;margin-right:0in">
<p class="MsoNormal" style="margin-bottom:12pt">Is there a way to set variables in syslog-ng?<br>
<br>
I have a log path with about 20 if/else branches and each one does a unnamed destination for that branch:<br>
<br>
log {<br>
source(pan_splunk);<br>
if ( tags('mytag') ) {<br>
destination {<br>
file("/var/log/remote/backup/$HOST/asa/${HOST}_asa.log"<br>
create-dirs(yes) dir-owner("splunk") dir-group("splunk") dir-perm(0750));<br>
};<br>
} elif ( message('something else') ) {<br>
destination {<br>
file("/var/log/remote/backup/$HOST/pubfw/${HOST}_pubfw.log"<br>
create-dirs(yes) dir-owner("splunk") dir-group("splunk") dir-perm(0750));<br>
};<br>
} elif {<br>
filter { message('foo') or<br>
message('bar') or<br>
message('baz') or<br>
...<br>
<br>
I'd need to introduce another directory level as a variable and I'd also like to change an existing part of the path to a variable so that then I could then do something like this:<br>
<br>
if ( tags('mytag') ) {<br>
app = asa<br>
location = msfc<br>
elif <br>
...<br>
<br>
and at the end I could then just do a single destination that had a file path with the variables<br>
file("/var/log/remote/backup/$location/$HOST/$app/${HOST}_$app.log"<br>
<br>
Thanks,<br>
-Mark<br>
<br>
<br>
<br>
______________________________________________________________________________<br>
Member info: <a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__lists.balabit.hu_mailman_listinfo_syslog-2Dng&d=DwMFaQ&c=ApwzowJNAKKw3xye91w7BE1XMRKi2LN9kiMk5Csz9Zk&r=zMyZvtxRXMBKZZYKVMke9zplWK320p3d51BzuU4jwWo&m=0oCgkJqh7N_Ja-VdtmDlAS5pzhA0puqJm8zcAaXJyjY&s=YY8TzLxmhOq_o7pu7ONHbV6I7OVpIy1P7TQUfp_hm8M&e=" target="_blank">
https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__www.balabit.com_support_documentation_-3Fproduct-3Dsyslog-2Dng&d=DwMFaQ&c=ApwzowJNAKKw3xye91w7BE1XMRKi2LN9kiMk5Csz9Zk&r=zMyZvtxRXMBKZZYKVMke9zplWK320p3d51BzuU4jwWo&m=0oCgkJqh7N_Ja-VdtmDlAS5pzhA0puqJm8zcAaXJyjY&s=DrlT7sUf5X_xKiPK3ca7WDhiw-xr4D7mtnSfL2yXiAQ&e=" target="_blank">
http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__www.balabit.com_wiki_syslog-2Dng-2Dfaq&d=DwMFaQ&c=ApwzowJNAKKw3xye91w7BE1XMRKi2LN9kiMk5Csz9Zk&r=zMyZvtxRXMBKZZYKVMke9zplWK320p3d51BzuU4jwWo&m=0oCgkJqh7N_Ja-VdtmDlAS5pzhA0puqJm8zcAaXJyjY&s=LvSPfbLLubjWgsCznHSgC7oIi6YzCi5LjVylqe_y5f8&e=" target="_blank">
http://www.balabit.com/wiki/syslog-ng-faq</a><u></u><u></u></p>
</blockquote>
</div>
</div>
</div>
______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
</blockquote></div>