Hi Gergely,
My configuration my of both client and server side.
>>>>>>>>>>>>>>>>>>>>>>>>>>>>client confg<<<<<<<<<<<<<<<<<<<<<<<<<<<
@version:3.13
@include "scl.conf"
@define allow-config-dups 1
#options {
# flush_lines (0);
# time_reopen (10);
# log_fifo_size (1000);
# chain_hostnames (off);
# use_dns (no);
# use_fqdn (no);
# create_dirs (no);
# keep_hostname (yes);
#};
source s_local {
system();
internal();
};
destination d_network {udp("192.168.122.67" port(514));
};
destination d_local {
file("/var/log/messages");
};
log{
source(s_local);
destination(d_network);
destination(d_local);
};
source s_local{
wildcard-file(
base-dir("/usr/local/apache/logs")
filename-pattern("*.log")
recursive(no)
follow-freq(1));
};
destination d_network {tcp("192.168.122.67" port(514));
};
log{
source(s_local);
destination(d_network);
};
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>server side cong<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
@version:3.13
@include "scl.conf"
source s_local{system(); internal();};
source s_network{
udp();
tcp();
};
destination d_local{file("/var/log/messages");};
destination d_from_net{file("/var/log/from_net");};
log{
source(s_local);
destination(d_local);
};
log { source(s_network); destination(d_from_net); };
source s_net {
network(flags(no-parse));
};
parser p_apache {
csv-parser(
columns("apache.FILE_NAME", "apache.MESSAGE")
flags(greedy)
);
};
destination d_apache {
file("/usr/local/apache/logs/${apache.FILE_NAME}"
template("${apache.MESSAGE}\n"));
};
log{
source (s_net);
parser (p_apache);
destination(d_apache);
};