Is it possible to do something like: rewrite { set-tag("bar"); }; And then use a rewrite to set the value of a variable to the value of the tag rewrite { set("${TAGS}", value("foo")); }; I need to set a value that I've determined in a log path at the top of the file in several log paths that occur after. It looks the scope for variables is at the log path level so that doesn't help me. I'm also trying to avoid nesting all of the other log paths inside of the top log path where I determine the value. I'm trying to avoid: log{ ... filter{ ... tags("bar"); rewrite{ set("bar", "foo"); }; }; }; log{... log{... Thanks, -Mark
On Thu, Jan 16, 2020 at 09:24:27PM +0000, Faine, Mark R. (MSFC-IS40)[NICS] wrote:
Is it possible to do something like:
rewrite { set-tag("bar"); };
And then use a rewrite to set the value of a variable to the value of the tag
A tag doesn't have a value. The $TAGS macro contains the list of all tags.
I need to set a value that I've determined in a log path at the top of the file in several log paths that occur after. It looks the scope for variables is at the log path level so that doesn't help me. I'm also trying to avoid nesting all of the other log paths inside of the top log path where I determine the value.
The scope of macros (aka name-value pairs or variables as you call them) and tags is the message. I think you're misunderstanding this. Once you do, step back and explain what you're trying to achieve :)
Forget tags, the goal is just to have a value that is set in one log path but available in other log paths that come after it. Thanks, -Mark
Hi! Perhaps a rewrite with SDATA? e.g. rewrite r_0110_f5_web { set("f5_web" value(".SDATA.custom@44084.1.syslogngrule")); }; in your "receiving" syslogpart and a filter f_0110_remote_sdata_rule { match("f5_web" value(".SDATA.custom@44084.1.syslogngrule")); }; afterwards? cheers Matthias ------------------------------------------------------------------------------------ METZLER Informationstechnologie Matthias Gruber IT-Infrastruktur & -Betrieb B. Metzler seel. Sohn & Co. Kommanditgesellschaft auf Aktien Untermainanlage 1 60329 Frankfurt am Main Telefon (0 69) 21 04 - 43 30 Telefax (0 69) 21 04 - 40 40 MGruber@metzler.com www.metzler.com Von: "Faine, Mark R. (MSFC-IS40)[NICS]" <mark.faine@nasa.gov> An: "wernli@in2p3.fr" <wernli@in2p3.fr>, "Syslog-ng users' and developers' mailing list" <syslog-ng@lists.balabit.hu> Datum: 17.01.2020 16:25 Betreff: Re: [syslog-ng] [EXTERNAL] Re: Rewrite set var value with tag? Gesendet von: "syslog-ng" <syslog-ng-bounces@lists.balabit.hu> Forget tags, the goal is just to have a value that is set in one log path but available in other log paths that come after it. Thanks, -Mark ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq Persönlich haftende Gesellschafter: Harald Illy, Michael Klaus, Friedrich von Metzler, Emmerich Müller, Gerhard Wiesheu Vorsitzender des Aufsichtsrats: Dr. Christoph Schücking Sitz der Gesellschaft: Frankfurt am Main, Handelsregister-Nr. HRB 27 515 Diese Nachricht ist vertraulich. Sollten Sie nicht der vorgesehene Empfänger sein, so bitten wir Sie höflich, dies unverzüglich dem Absender mitzuteilen und die Nachricht zu löschen. Es ist unzulässig, die Nachricht unbefugt weiterzuleiten oder zu kopieren. Da wir nicht die Echtheit oder Vollständigkeit der in dieser Nachricht enthaltenen Informationen garantieren oder zusichern können, sind die vorstehenden Ausführungen rechtlich nicht bindend. Eine Haftung hierfür wird ausgeschlossen. This message is confidential. If you are not the intended recipient, we kindly ask you to inform the sender and delete the information. Any unauthorised dissemination or copying hereof is prohibited. As we cannot guarantee or assure the genuineness or completeness of the information contained in this message, the statements set forth above are not legally binding. Accordingly we cannot accept any liability for their contents.
participants (3)
-
Fabien Wernli
-
Faine, Mark R. (MSFC-IS40)[NICS]
-
Matthias Gruber