Use multiple templates for a single file?
Hi Is it somehow possible to apply multiple templates to a single destination/file? My current setup is something along the lines of: destination dst_foo_1 { file("foo_1.log" template(template_foo_1)); }; destination dst_foo_2 { file("foo_2.log" template(template_foo_2)); }; template template_foo_1 { template("$A $B $C"); }; template template_foo_2 { template("$D $E $F"); }; log { source(src_udp); filter(filter_condition_1); parser(parser_foo); destination(dst_foo_1); flags(final); }; log { source(src_udp); filter(filter_condition_2); parser(parser_foo); destination(dst_foo_2); flags(final); }; However, I would really like to write log into a single file - but with two different templates depending on the matched filter. Is that possible? I don't suppose pointing both destinations to the same file would be wise? /Mikkel
"Mikkel Leth Carlsen" <mlca@tdc.dk> writes:
Is it somehow possible to apply multiple templates to a single destination/file? My current setup is something along the lines of:
I do not think this would be possible easily. The problem is that templates are tied to the file() destination, and you're right that two different destinations pointing to the same file is Not A Good Idea(tm). The workaround I'd suggest is to create a new source that's not a file, but something where overlapping writes are not an issue (such as tcp), and point both of your dst_foo_* to that. Then create another destination, the real file destination, and a logpath that connects these two. This way, you'll have two or more destinations with different templates looped back to syslog-ng, as a new source, which in turn gets stored in a file. Hopefully the above was clear enough, even without a config example. -- |8]
On Fri, 2012-03-23 at 08:48 +0100, Mikkel Leth Carlsen wrote:
Hi
Is it somehow possible to apply multiple templates to a single destination/file? My current setup is something along the lines of:
destination dst_foo_1 {
file("foo_1.log" template(template_foo_1));
};
destination dst_foo_2 {
file("foo_2.log" template(template_foo_2));
};
template template_foo_1 {
template(“$A $B $C”);
};
template template_foo_2 {
template(“$D $E $F”);
};
log {
source(src_udp);
filter(filter_condition_1);
parser(parser_foo);
destination(dst_foo_1);
flags(final);
};
log {
source(src_udp);
filter(filter_condition_2);
parser(parser_foo);
destination(dst_foo_2);
flags(final);
};
However, I would really like to write log into a single file – but with two different templates depending on the matched filter. Is that possible? I don’t suppose pointing both destinations to the same file would be wise?
With template functions you can do this within your template using $(if) template("$(if filter(filter_condition_1) '$A $B $C' '$D $E $F'))"); Assuming that filter_condition_1 is false if filter_condition_2 is true. If that's not the case it becomes slightly more complicated, needs an embedded $(if): template("$(if filter(filter_condition_1) '$A $B $C' $(if filter(filter_condition_2) '$D $E $F' 'unmatched')))"); For this I think you need 3.3 -- Bazsi
participants (3)
-
Balazs Scheidler
-
Gergely Nagy
-
Mikkel Leth Carlsen