[syslog-ng] Launching command with a certain value after extracting it from patterndb

[Fabien Wernli]

Hi,

On Wed, Nov 05, 2014 at 01:47:50PM +0000, C. L. Martinez wrote:
> $user. Can I trigger a command like "cat $user >> /tmp/users.log"
> without calling a script??

Yes, you can!
The idea is to have a file destination with a custom template.

For instance:

-----8<----

filter f_patterndb_rule_id_12345 {
	match("12345" value(".classifier.rule_id"))
};

template t_users {
  template("${user}\n");
};

destination d_file_users {
  file("/tmp/users.log" template(t_users));
};

log {
  source(s_mysource);
  parser(p_mypatterndb);
  filter(f_patterndb_rule_id_12345);
  destination(d_file_users);
};
----->8----