[syslog-ng] [EXTERNAL] Re: Help with embedded log paths

[Gabor Nagy (gnagy)]

There is a ${FILE_NAME} macro:
https://www.syslog-ng.com/technical-documents/doc/syslog-ng-open-source-edition/3.36/administration-guide/75#macro-filename

Or you could add a tag() to the source statement with a string literal, so only messages from that source will have that string.

Gabor
________________________________
From: syslog-ng <syslog-ng-bounces at lists.balabit.hu> on behalf of Fabien Wernli <wernli at in2p3.fr>
Sent: Friday, March 25, 2022 8:49
To: Faine, Mark R. (MSFC-IS40)[NICS] <mark.faine at nasa.gov>
Cc: Syslog-ng users' and developers' mailing list <syslog-ng at lists.balabit.hu>
Subject: Re: [syslog-ng] [EXTERNAL] Re: Help with embedded log paths

CAUTION: This email originated from outside of the organization. Do not follow guidance, click links, or open attachments unless you recognize the sender and know the content is safe.


Hi Mark,

Good to hear the if/else model suits you!

On Thu, Mar 24, 2022 at 07:36:58PM +0000, Faine, Mark R. (MSFC-IS40)[NICS] wrote:
> I need some sort of unique identifier that I can put on the file name in a destination that is static and not tied to the message or anything else that changes.  It should be created when the file is created and not changed.
>
> I've looked over the macros but I don't see anything, does something like this exist?

All the macros are tied to each and every message, and that's by design:
routing is done per message. If you want something tied to a destination,
all I can suggest is to set it as close as possible to that destination.
For instance, you can set it *in* the destination as follows:

    destination d_foo {
      channel {
        rewrite {
          set("my_static_vaule", value("MY_STATIC_MACRO")};
        };
        destination {
          file("/path/to/dest" ...};
        };
      };
    };

______________________________________________________________________________
Member info: https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.balabit.hu%2Fmailman%2Flistinfo%2Fsyslog-ng&data=04%7C01%7Cgabor.nagy%40oneidentity.com%7C281263658a24442eda3f08da0e3400b7%7C91c369b51c9e439c989c1867ec606603%7C0%7C1%7C637837913805954664%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=JwlArTRL1rTCbUHyADaEBOYtBhKkcJ1fQh%2FcU9qyANg%3D&reserved=0
Documentation: https://nam12.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.balabit.com%2Fsupport%2Fdocumentation%2F%3Fproduct%3Dsyslog-ng&data=04%7C01%7Cgabor.nagy%40oneidentity.com%7C281263658a24442eda3f08da0e3400b7%7C91c369b51c9e439c989c1867ec606603%7C0%7C1%7C637837913805954664%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=4lHfSUwrKwRGMGgQLWxNRNphYddMPfJrusHuZZ5BHME%3D&reserved=0
FAQ: https://nam12.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.balabit.com%2Fwiki%2Fsyslog-ng-faq&data=04%7C01%7Cgabor.nagy%40oneidentity.com%7C281263658a24442eda3f08da0e3400b7%7C91c369b51c9e439c989c1867ec606603%7C0%7C1%7C637837913805954664%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=s94ztS49SqoXTnM4MhPFaThvHSGFJQu94yOx8DkMwW4%3D&reserved=0

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.balabit.hu/pipermail/syslog-ng/attachments/20220325/2e947c0a/attachment.htm>