A while back I was asking about the
json parser and how to get the TAGS from the json object into the
TAGS of the syslog-ng internal structure so that I could make
filters on them.
Now I am trying again, following Balazs suggestion of using
set-tag(), however, I find that the rewrite
rewrite r_set_sometag {
set-tag("sometag" condition(filter(f_should_set_sometag)) );
};
is not supported.
I thought that I would be able to use the filter in the log
statement such as
log {
source(s_some);
log {
filter(f_should_set_sometag);
rewrite(r_set_sometag);
destination(d_dest);
};
};
This works for one tag, but I have multiple tags that I want to
set which gives be a factorial(N)
branching sequence which is not feasible.
Using junction/channels ends up producing multiple output lines
when multiple TAGS are set :-(
Can anyone think of a way to set an arbitrary set of TAGS on a
syslog message given an
arbitrary set of "set-tag-flags" presented in other macro values?
Should the set-tag rewrite support conditionals?
Thanks in advance ... again.
Evan.
On 03/28/2013 09:56 PM, Balazs Scheidler wrote:
Hi,
the simplest way right now is the set-tag() rewrite operation,
that together with condition() might do the trick.
I know there should be an easier way, but I'm afraid there
isn't.
I'm thinking about how this should work in the long term, but
right now I don't have a clear idea.
----- Original message -----
> I have a situation where syslog-ng processes a syslog line,
users
> paserdb and does lots of work and finally sends the
complete object via
> json to an external application. This application does some
thinking and
> based on some other data sources needs to send the log
message back into
> syslog-ng with a different set of TAGS so that it gets
routed through
> syslog-ng to a different destination program.
>
> The problem I am having is that syslog-ng does not use the
TAGS in the
> incoming json object. The TAGS get replaced with the TAGS
on the
> "source" of the syslog-ng that reads the json object, and
augmented with
> any patterndb processing.
>
> Can anyone think of a way to get some arbitrary set of TAGS
(possibly in
> a different custom macro) placed into the TAGS macro so
that all of the
> filters on tags can be used.
>
> For example, I could make a patterndb for each individual
tag value, and
> invoke each patterndb on the MyTags value. If there is a
match then tag
> the message with the TAG. I would need to know all of the
TAGS in
> advance and would probably not perform all that well, but
it would work.