On Mon, Oct 18, 2010 at 12:25:50PM -0600, Bill Anderson wrote:
On Oct 18, 2010, at 11:48 AM, Bill Anderson wrote:
Perhaps doing the rewrite then using a patterndb entry? I'll go try that.
Nope. Rewriting host1 to host-1 then calling the patterndb does not work. Reasoning: rewriting the APACHE.ROLEHOST has no effect on $MSG, which is what the patterndb gets. Which in hindsight, I should have known.
Hi Bill, I did try to follow your first email but it got complicated and covered some areas of the syslog-ng product I have not used before so I am not sure if you tried this already or not. I was thinking maybe you might be able to help your situation by using APACHE.ROLEHOST in the output file naming template. Once you have added that variable to the message it should stay there despite further parsings with CSV or patterndb unless overwritten. So once you created the APACHE.ROLEHOST variable the first time using CSV parser, you could still probably reference it in your arguments to the file() driver or other output driver template.
Cheers, Bill
Good Luck, Matthew.