I can understand that, however, if you’re trying to convert yaml into a log path it would be hard to do if/else dynamically.  I am curious about how the declaration order matters.  My understanding is that each message will be evaluated for a match on each log statement in the order that they appear in the file and only when it hits a log statement with a final flag will it stop attempting to match.  Is that correct?

Thanks,

-Mark                  

From: syslog-ng <syslog-ng-bounces@lists.balabit.hu> On Behalf Of Nagy, Gábor
Sent: Thursday, May 9, 2019 6:25 AM
To: wernli@in2p3.fr; Syslog-ng users' and developers' mailing list <syslog-ng@lists.balabit.hu>
Subject: Re: [syslog-ng] Multiple log statements vs If/else

Hi,

> The if/then/else control is much more readable, and I believe it was

> implemented for that reason. That being said, you can achieve the same
> behaviour with multiple log paths + flags, or embedded log paths and
> channels/junctions. Be aware however that in the former, declaration order
> matters.

Yes, that's correct.

We prefer using if-elif statements instead of using junction/channels with final flags (because if-elif are basically just that) for convenience.

In if-elif statements there are even some flexibility you can configure (what should be used for the conditional expression), for details let me link our Admin guide:
https://www.syslog-ng.com/technical-documents/doc/syslog-ng-open-source-edition/3.20/administration-guide/51#TOPIC-1121970

Regards,

Gabor

On Thu, May 9, 2019 at 9:18 AM Fabien Wernli <wernli@in2p3.fr> wrote:

Hi,

On Wed, May 08, 2019 at 01:28:46PM +0000, Faine, Mark R. (MSFC-IS40)[NICS] wrote:
> I was thinking about trying to build a configuration specific for an app from a Jinja2 template in Ansible and it seems like to me that if they aren't different it would be easier to do multiple log statements if generated dynamically.

The if/then/else control is much more readable, and I believe it was
implemented for that reason. That being said, you can achieve the same
behaviour with multiple log paths + flags, or embedded log paths and
channels/junctions. Be aware however that in the former, declaration order
matters.

______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq