Am 18.05.2011 00:16, schrieb Gergely Nagy:
Yes, it is. You can use filters, somewhat like this:
filter f_connect { message("*connect*" type(glob)); };
You can use regular expressions in the filter too - just remove the type(glob) part then.
And then add filter(f_connect); to your log block:
log { source(src); destination(messages); filter(f_connect); destination(d_mysql); };
This will log all messages to the messages destination, but only filtered ones to mysql. As far as I understand it, anyway. I usually use separate log blocks:
log { source(src); destination(messages); };
log { source(src); filter(f_connect); destination(d_mysql); };
With your code - all messages are in the database. I only want to have the messages, which have the word "connect" in the message. I tried to do it in this way: options { chain_hostnames(off); sync(0); stats(43200); }; source src { unix-stream("/dev/log"); internal(); pipe("/proc/kmsg"); }; # filter f_connect { msg("/connect/" type(glob));}; filter f_connect { match ("/connect/");}; destination d_mysql { program("/usr/bin/mysql --user=username --password=myword database" template("INSERT INTO logs (host, facility, priority, level, tag, datetime, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC','$PROGRAM', '$MSG' );\n") template-escape(yes)); }; destination messages { file("/var/log/mail.log"); }; log { source(src); filter (f_connect); destination(messages); destination(d_mysql); };