Previous syslog-ng versions supports only the 2.x mongodb
series, 3.2.x series is supported only by the syslog-ng
upstream (version 3.8).
We moved to the official mongo-c library and -temporary-
broke the configuration (we have a PR[1] that will support the
previous config format - we will merge this soon). Until we
won't merge the patch, you can use the new config options.
So if you want to use the 3.2.x mongodb, you have to
compile syslog-ng from source.
1. docker: install mongodb 3.2.5
2. start mongodb
root@a3e9571e39eb:/# mongod --bind_ip 172.17.0.2
3. build & configure
cd syslog-ng
./autogen.sh
cd ..
mkdir build
cd build
../syslog-ng/configure --prefix /opt/syslog-ng.upstream
make
make install
[if you need help on howto compile syslog-ng, we can
help]
/opt/syslog-ng.upstream/etc/syslog-ng.conf:
@version: 3.8
@include "scl.conf"
source s_network {
network(port(5555));
};
destination d_mongo {
mongodb (
collection('test')
value-pairs(
scope("selected-macros" "nv-pairs" "sdata")
)
);
};
log {
source(s_network);
destination(d_mongo);
flags(flow-control);
};
4. send logs
stentor@T440s:~$ logger -s MSG:$RANDOM 2>&1 | nc
localhost 5555
5. query the results
MongoDB shell version: 3.2.5
> db.test.find({'PROGRAM':'stentor'})
{ "_id" : ObjectId("57179ae358d80574d81440e1"), "TAGS" :
> ".source.s_network", "SOURCEIP" : "127.0.0.1",
"SOURCE" : "s_network",
> "SEQNUM" : "1", "PROGRAM" : "stentor", "PRIORITY" :
"notice", "MESSAGE" :
> "MSG:4854", "LEGACY_MSGHDR" : "stentor: ",
"HOST_FROM" : "localhost",
> "HOST" : "localhost", "FACILITY" : "user", "DATE" :
"Apr 20 17:06:11" }
{ "_id" : ObjectId("57179ae858d80574d81440e2"), "TAGS" :
> ".source.s_network", "SOURCEIP" : "127.0.0.1",
"SOURCE" : "s_network",
> "SEQNUM" : "2", "PROGRAM" : "stentor", "PRIORITY" :
"notice", "MESSAGE" :
> "MSG:31751", "LEGACY_MSGHDR" : "stentor: ",
"HOST_FROM" : "localhost",
> "HOST" : "localhost", "FACILITY" : "user", "DATE" :
"Apr 20 17:06:16" }
{ "_id" : ObjectId("57179b1958d80574ff238bf1"), "TAGS" :
> ".source.s_network", "SOURCEIP" : "127.0.0.1",
"SOURCE" : "s_network",
> "SEQNUM" : "1", "PROGRAM" : "stentor", "PRIORITY" :
"notice", "MESSAGE" :
> "MSG:13698", "LEGACY_MSGHDR" : "stentor: ",
"HOST_FROM" : "localhost",
> "HOST" : "localhost", "FACILITY" : "user", "DATE" :
"Apr 20 17:07:05" }
>