Hi,

I’m a noobie and just about beginning to try out syslog-ng at my company.  I have the following configuration on the client:

source s_apache {

        file("/apps/log/apache/store-dev03/*"

        program_override("apache")

        flags(no-parse)

        );

};

destination d_remote {

    syslog("10.5.76.125" transport("tcp") port(514)

#    template("${MSGONLY}")

    );

};

log {

        source(s_apache);

        destination(d_remote);

};

And something like this on the server side:

source s_network {

   syslog(ip(0.0.0.0)

        port(514) transport("tcp") );

};

destination d_local {

    file("/apps/log/syslong-ng/$PROGRAM/$HOST/$YEAR$MONTH$DAY.log"

    # ignore the use of template below, I just wanted to prove the server side could

    # see the value of the filepath from the client

    template("${.SDATA.file@18372.4.name} - ${MSGONLY}\n")

    );

};

log {

   source(s_network);

   destination(d_local);

};

My ("${.SDATA.file@18372.4.name} value can be something like this: ‘/apps/log/apache/store-dev03/access.log’. What I want to be able to do is to parse that path.  That is to discard the begining of the path, /apps/log/apache.  Get the rest of the value, especially the file name (access.log) to be used to construct destination path.

Is this possible?  Thank you for your kind help.