[syslog-ng] Value is dropped or unset in resolved destination template

Faine, Mark R. (MSFC-IS40)[NICS] mark.faine at nasa.gov
Tue Mar 22 20:22:03 UTC 2022


I have a destination template in my destination (d_default) that uses $location

destination d_default {
        file("`BASEPATH`/$location/$(lowercase ${HOST})/$app/$(lowercase ${HOST})_$app.log"
        create_dirs(yes)
        flags("threaded", "no-multi-line"));
      };



That is set by a series of filters that look like this

log {
  if {
   filter...
   rewrite {
     set("foo" value("location"));
   };
};
  if {
   filter...
   rewrite {
     set("bar" value("location"));
   };
};

...

};

This appears to be working, I can see it in the logs:

Setting value; name='location', value='unknown', msg='0x7f190c001e00'  # Unknown is a default value that would be appropriate on this testing server

Later additional log paths are applied like so:

log { source(default); filter(f_asa); rewrite(r_asa); destination(d_default); flags(final ); };

...
log { source(default); filter(f_fw); rewrite(r_fw); destination(d_default); flags(final ); };
...


However, when I go to the destination on the filesystem the location is empty so the files are being written as though location was this:
("`BASEPATH`//$(lowercase ${HOST})/$app/$(lowercase ${HOST})_$app.log"


Any ideas what could be causing this?

Thanks,
Mark


More information about the syslog-ng mailing list