[syslog-ng] Is it possible to include a external python script?

[Jorge Pereira]

hi Bazsi,

yes! I saw the code and looks to be easy.

btw, is it possible to rewrite the $MESSAGE var using python? I have tried
the below code without success.

python {
import socket

def resolve_host(logmsg, hostname):
    try:
        logmsg["MESSAGE"] = "My caipirinha!"
        return socket.gethostbyaddr(hostname)[0]
    except (socket.herror, socket.error):
        return 'unknown'

};

destination d_python {
    file("/tmp/test.txt" template("@@@ ${ISODATE} # $(python resolve_host
200.221.2.44) # ${MESSAGE} \n"));
};


--
Jorge Pereira

On Tue, Mar 21, 2017 at 2:27 AM, Scheidler, Balázs <
balazs.scheidler at balabit.com> wrote:

> Hi,
>
> No there's not, you can include one using the syslog-ng @include
> mechanism, but in that case the python block needs to be part of that file.
> And yes, you can achieve the same using the confgen module as well, but
> that would execute an external script.
>
> It probably wouldn't be very difficult to implement this syntax:
>
> python "python-script.py";
>
> Which would execute that file instead of the python block (look at
> python-main.c and its evaluate_global_code function), but there's no such
> functionality now.
>
> Cheers,
> Bazsi
>
>
> --
> Bazsi
>
> On Mon, Mar 20, 2017 at 5:34 PM, Jorge Pereira <jpereiran at gmail.com>
> wrote:
>
>> Hi Balázs,
>>
>> Thanks for the answer. But, My question is: It is possible to include a
>> external python script.
>>
>> e.g:
>>
>> $ cat foobar.conf:
>>
>> python {
>>    @include "caipirinha.py"
>> }
>>
>> template-function foobar "$(python foobar)"
>>
>> $ cat caipirinha.py
>> from foobar import foobar_template_function
>> # my python class/code is separated
>> ...........
>>
>> $
>>
>> got it? maybe using the "confgen" module?
>> --
>> Jorge Pereira
>>
>> On Mon, Mar 20, 2017 at 2:35 AM, Scheidler, Balázs <
>> balazs.scheidler at balabit.com> wrote:
>>
>>> Hi,
>>>
>>> The example Python code should be unindented, or you see a different
>>> error?
>>>
>>> Also, you can always import code in the python block.
>>>
>>> With destinations you can specify a path to a python file, so the python
>>> block is not needed. But with template functions I've figured the $(python)
>>> call would be too crowded if we were passing explicit filename parameters.
>>>
>>> But you can encapsulate the python code as well as a wrapper to the
>>> python code into a separate file.
>>>
>>> Foobar.conf:
>>>
>>> python {
>>>
>>> from foobar import foobar_template_function
>>>
>>> }
>>>
>>> template-function foobar "$(python foobar)"
>>>
>>> ----------
>>>
>>> Then you can use:
>>>
>>> @include "Foobar.conf"
>>>
>>> ...
>>> template("$(foobar)");
>>> ...
>>>
>>> Unfortunately then template function declarations cant take parameters
>>> yet from the callsite, which may be a serious limitation in your use-case.
>>> But with a conceot above you can completely hide implementation details
>>> your actual config.
>>>
>>> On Mar 20, 2017 03:53, "Jorge Pereira" <jpereiran at gmail.com> wrote:
>>>
>>>> Well, based on this[1] document. We should use the *python {}* statement.
>>>> But, I would like to keep my python script externally in a separated file
>>>> and do something like.
>>>>
>>>> python filter_001 {
>>>>    /my/script/python001.py
>>>> }
>>>>
>>>> log {
>>>>    ....
>>>>    filter(filter_001);
>>>>    ....
>>>> };
>>>>
>>>> p.s: Btw, this sample https://www.balabit.com
>>>> /documents/syslog-ng-ose-3.7-guides/en/syslog-ng-ose-guide-a
>>>> dmin/html-single/index.html#example-python-template-functions
>>>> don't work in the syslog-ng 3.9.1
>>>>
>>>> [1] https://www.balabit.com/sites/default/files/documents/syslog
>>>> -ng-ose-3.7-guides/en/syslog-ng-ose-v3.7-guide-admin/html-si
>>>> ngle/index.html#example-python-template-functions
>>>> --
>>>> Jorge Pereira
>>>>
>>>> ____________________________________________________________
>>>> __________________
>>>> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
>>>> Documentation: http://www.balabit.com/support
>>>> /documentation/?product=syslog-ng
>>>> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>>>>
>>>>
>>>>
>>> ____________________________________________________________
>>> __________________
>>> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
>>> Documentation: http://www.balabit.com/support
>>> /documentation/?product=syslog-ng
>>> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>>>
>>>
>>>
>>
>> ____________________________________________________________
>> __________________
>> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
>> Documentation: http://www.balabit.com/support/documentation/?product=
>> syslog-ng
>> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>>
>>
>>
>
> ____________________________________________________________
> __________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation: http://www.balabit.com/support/documentation/?
> product=syslog-ng
> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.balabit.hu/pipermail/syslog-ng/attachments/20170322/49503c3f/attachment.html>