[syslog-ng] set tag in log statement

Patrick Hemmer syslogng at feystorm.net
Fri Dec 16 21:59:32 CET 2011


Would it be possible to set tags on a message when it is matched by a 
`log {}` statement? This would be useful for complex log configurations 
so you could filter out messages that were logged by previous `log {}` 
statements without having to write really long `filter {}`s.

I'm not sure if this is possible or not. Would depend on the order of 
operations, like if a filter block in a latter log statement is 
evaluated at the same time as an earlier filter block, or if its 
evaluated when it reaches the `log {}`.

Such a config would look like

filter f_a { facility(mail); };
log { source(s_local); filter(f_a); destination(d_a); tags("tag1"); };

filter f_b { facility(local0); };
log { source(s_local); filter(f_b); destination(d_b); tags("tag1"); };

filter f_c { not tags("tag1"); };
log { source(s_local); filter(f_c); destination (d_c); };


More information about the syslog-ng mailing list