[syslog-ng] Extract portion of SDATA file name?

21 Feb 2012

      Hi,

I'm a noobie and just about beginning to try out syslog-ng at my company.  I have the following configuration on the client:

source s_apache {
        file("/apps/log/apache/store-dev03/*"
        program_override("apache")
        flags(no-parse)
        );
};
destination d_remote {
    syslog("10.5.76.125" transport("tcp") port(514)
#    template("${MSGONLY}")
    );
};
log {
        source(s_apache);
        destination(d_remote);
};

And something like this on the server side:
source s_network {
   syslog(ip(0.0.0.0)
        port(514) transport("tcp") );
};
destination d_local {
    file("/apps/log/syslong-ng/$PROGRAM/$HOST/$YEAR$MONTH$DAY.log"
    # ignore the use of template below, I just wanted to prove the server side could
    # see the value of the filepath from the client
    template("${.SDATA.file@18372.4.name} - ${MSGONLY}\n")
    );
};
log {
   source(s_network);
   destination(d_local);
};

My ("${.SDATA.file@18372.4.name} value can be something like this: '/apps/log/apache/store-dev03/access.log'. What I want to be able to do is to parse that path.  That is to discard the begining of the path, /apps/log/apache.  Get the rest of the value, especially the file name (access.log) to be used to construct destination path.

Is this possible?  Thank you for your kind help.

[syslog-ng] Extract portion of SDATA file name?

Andika Daud