Mailing List Archive

ruleset name as variable
Good day,

I was reading the section about the variables and the exec_template but honestly I couldn't able to get enough (maybe because there are not enough examples) so I would like to ask if it possible to set a variable with the current ruleset name. Example:

ruleset(name="blabla")
set somevar= <ruleset name>

Regards,
Alexandros

This message (including any attachments) may contain confidential information. It is intended for use by the recipient only. Any dissemination, copying or distribution to third parties without the express consent of the sender is strictly prohibited. If you have received this message in error, please delete it immediately and notify the sender. Thank you for your collaboration.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: ruleset name as variable [ In reply to ]
El mar., 2 jul. 2019 a las 12:56, Naoum, A. (Alexandros) via rsyslog
(<rsyslog@lists.adiscon.com>) escribió:
>
>
>
> Good day,
>
> I was reading the section about the variables and the exec_template but honestly I couldn't able to get enough (maybe because there are not enough examples) so I would like to ask if it possible to set a variable with the current ruleset name. Example:
>
> ruleset(name="blabla")
> set somevar= <ruleset name>

not directly, but you could do:

ruleset(name="blabla") {
set blabla_oldrs = $.ruleset;
set $.ruleset = "blabla";
... do work ...
set $.ruleset = blabla_oldrs;
}

This mimics a stack of ruleset names.

HTH
Rainer
>
> Regards,
> Alexandros
>
> This message (including any attachments) may contain confidential information. It is intended for use by the recipient only. Any dissemination, copying or distribution to third parties without the express consent of the sender is strictly prohibited. If you have received this message in error, please delete it immediately and notify the sender. Thank you for your collaboration.
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: ruleset name as variable [ In reply to ]
Thank you for the reply.

It is a good way but in my scenario... probably will not provide what I want to get.
I want to reuse this variable as part of the file name on omfile module in multiple rulesets (different sources in each).

So instead of having multiple templates with static parts/names I want to use one template that will get a part of the file name from the ruleset (or from the actual .conf file).


Regards,
Alexandros

-----Original Message-----
From: Rainer Gerhards <rgerhards@hq.adiscon.com>
Sent: Tuesday, July 2, 2019 1:09 PM
To: rsyslog-users <rsyslog@lists.adiscon.com>
Cc: Naoum, A. (Alexandros) <alexandros.naoum@nn.cz>
Subject: Re: [rsyslog] ruleset name as variable

El mar., 2 jul. 2019 a las 12:56, Naoum, A. (Alexandros) via rsyslog
(<rsyslog@lists.adiscon.com>) escribió:
>
>
>
> Good day,
>
> I was reading the section about the variables and the exec_template but honestly I couldn't able to get enough (maybe because there are not enough examples) so I would like to ask if it possible to set a variable with the current ruleset name. Example:
>
> ruleset(name="blabla")
> set somevar= <ruleset name>

not directly, but you could do:

ruleset(name="blabla") {
set blabla_oldrs = $.ruleset;
set $.ruleset = "blabla";
... do work ...
set $.ruleset = blabla_oldrs;
}

This mimics a stack of ruleset names.

HTH
Rainer
>
> Regards,
> Alexandros
>
> This message (including any attachments) may contain confidential information. It is intended for use by the recipient only. Any dissemination, copying or distribution to third parties without the express consent of the sender is strictly prohibited. If you have received this message in error, please delete it immediately and notify the sender. Thank you for your collaboration.
> _______________________________________________
> rsyslog mailing list
> https://eur01.safelinks.protection.outlook.com/?url=http%3A%2F%2Flists
> .adiscon.net%2Fmailman%2Flistinfo%2Frsyslog&amp;data=02%7C01%7Calexand
> ros.naoum%40nn.cz%7C06dab42aae2245a2d25608d6feddc1b2%7Cfed95e698d7343f
> eaffba7d85ede36fb%7C1%7C0%7C636976625745954512&amp;sdata=1t%2FLC2UnTfH
> 30fGKQZ%2Fy1bK2iBXjVsX7BaiV8aLBrUY%3D&amp;reserved=0
> https://eur01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.r
> syslog.com%2Fprofessional-services%2F&amp;data=02%7C01%7Calexandros.na
> oum%40nn.cz%7C06dab42aae2245a2d25608d6feddc1b2%7Cfed95e698d7343feaffba
> 7d85ede36fb%7C1%7C0%7C636976625745954512&amp;sdata=fxbA2ocApUlu0a7bAWN
> %2BQEcjw4UmledslZ%2B1dAi8DPM%3D&amp;reserved=0
> What's up with rsyslog? Follow
> https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftwit
> ter.com%2Frgerhards&amp;data=02%7C01%7Calexandros.naoum%40nn.cz%7C06da
> b42aae2245a2d25608d6feddc1b2%7Cfed95e698d7343feaffba7d85ede36fb%7C1%7C
> 0%7C636976625745954512&amp;sdata=UwlMB7zeyu6swvQN58EQNSiCjKKTtRaFzSV%2
> F9EuqEyM%3D&amp;reserved=0 NOTE WELL: This is a PUBLIC mailing list,
> posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
This message (including any attachments) may contain confidential information. It is intended for use by the recipient only. Any dissemination, copying or distribution to third parties without the express consent of the sender is strictly prohibited. If you have received this message in error, please delete it immediately and notify the sender. Thank you for your collaboration.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: ruleset name as variable [ In reply to ]
El mar., 2 jul. 2019 a las 13:15, Naoum, A. (Alexandros)
(<alexandros.naoum@nn.cz>) escribió:
>
>
> Thank you for the reply.
>
> It is a good way but in my scenario... probably will not provide what I want to get.
> I want to reuse this variable as part of the file name on omfile module in multiple rulesets (different sources in each).

variables are NOT local to rulesets. If you do not need a stack, you
can just use

set $.rsname="name";
and use that in the template. That's it.

Rainer
>
> So instead of having multiple templates with static parts/names I want to use one template that will get a part of the file name from the ruleset (or from the actual .conf file).
>
>
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: ruleset name as variable [ In reply to ]
That sound better but I'm not sure if I done it correct because doesn't work.

I put this line before the ruleset definition:

set $!sourcetype = "syslog_checkpoint_test";

I have a template:

template(name="DynIPFile_test" type="string" string="/var/log/logs/%$!sourcetype%/%FROMHOST-IP%/%FROMHOST-IP%.log")

In the action I have this:

action(name="action_syslog_checkpoint2"
type="omfile"
DynaFile="DynIPFile_test")

Regards,
Alexandros

-----Original Message-----
From: Rainer Gerhards <rgerhards@hq.adiscon.com>
Sent: Tuesday, July 2, 2019 1:18 PM
To: Naoum, A. (Alexandros) <alexandros.naoum@nn.cz>
Cc: rsyslog-users <rsyslog@lists.adiscon.com>
Subject: Re: [rsyslog] ruleset name as variable

El mar., 2 jul. 2019 a las 13:15, Naoum, A. (Alexandros)
(<alexandros.naoum@nn.cz>) escribió:
>
>
> Thank you for the reply.
>
> It is a good way but in my scenario... probably will not provide what I want to get.
> I want to reuse this variable as part of the file name on omfile module in multiple rulesets (different sources in each).

variables are NOT local to rulesets. If you do not need a stack, you can just use

set $.rsname="name";
and use that in the template. That's it.

Rainer
>
> So instead of having multiple templates with static parts/names I want to use one template that will get a part of the file name from the ruleset (or from the actual .conf file).
>
>
This message (including any attachments) may contain confidential information. It is intended for use by the recipient only. Any dissemination, copying or distribution to third parties without the express consent of the sender is strictly prohibited. If you have received this message in error, please delete it immediately and notify the sender. Thank you for your collaboration.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: ruleset name as variable [ In reply to ]
full config pls

El mar., 2 jul. 2019 a las 14:13, Naoum, A. (Alexandros)
(<alexandros.naoum@nn.cz>) escribió:
>
>
>
> That sound better but I'm not sure if I done it correct because doesn't work.
>
> I put this line before the ruleset definition:
>
> set $!sourcetype = "syslog_checkpoint_test";
>
> I have a template:
>
> template(name="DynIPFile_test" type="string" string="/var/log/logs/%$!sourcetype%/%FROMHOST-IP%/%FROMHOST-IP%.log")
>
> In the action I have this:
>
> action(name="action_syslog_checkpoint2"
> type="omfile"
> DynaFile="DynIPFile_test")
>
> Regards,
> Alexandros
>
> -----Original Message-----
> From: Rainer Gerhards <rgerhards@hq.adiscon.com>
> Sent: Tuesday, July 2, 2019 1:18 PM
> To: Naoum, A. (Alexandros) <alexandros.naoum@nn.cz>
> Cc: rsyslog-users <rsyslog@lists.adiscon.com>
> Subject: Re: [rsyslog] ruleset name as variable
>
> El mar., 2 jul. 2019 a las 13:15, Naoum, A. (Alexandros)
> (<alexandros.naoum@nn.cz>) escribió:
> >
> >
> > Thank you for the reply.
> >
> > It is a good way but in my scenario... probably will not provide what I want to get.
> > I want to reuse this variable as part of the file name on omfile module in multiple rulesets (different sources in each).
>
> variables are NOT local to rulesets. If you do not need a stack, you can just use
>
> set $.rsname="name";
> and use that in the template. That's it.
>
> Rainer
> >
> > So instead of having multiple templates with static parts/names I want to use one template that will get a part of the file name from the ruleset (or from the actual .conf file).
> >
> >
> This message (including any attachments) may contain confidential information. It is intended for use by the recipient only. Any dissemination, copying or distribution to third parties without the express consent of the sender is strictly prohibited. If you have received this message in error, please delete it immediately and notify the sender. Thank you for your collaboration.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: ruleset name as variable [ In reply to ]
set $!sourcetype = "syslog_checkpoint_ids_test";
template(name="DynIPFile" type="string" string="/var/log/logs/syslog_checkpoint_ids/%FROMHOST-IP%/%FROMHOST-IP%.log")
template(name="DynIPFile_test" type="string" string="/var/log/logs/%$!sourcetype%/%FROMHOST-IP%/%FROMHOST-IP%.log")
ruleset(name="syslog_checkpoint_ids"
queue.type="Direct"
queue.timeoutenqueue="0")
{
if $fromhost-ip == [
"15.112.10.6",
"15.112.10.5",
"15.112.10.4",
]
then {
action(name="action_syslog_checkpoint"
type="omfile"
DynaFile="DynIPFile")
action(name="action_syslog_checkpoint2"
type="omfile"
DynaFile="DynIPFile_test")

stop
}
}


Regards,
Alexandros

-----Original Message-----
From: Rainer Gerhards <rgerhards@hq.adiscon.com>
Sent: Tuesday, July 2, 2019 2:16 PM
To: Naoum, A. (Alexandros) <alexandros.naoum@nn.cz>
Cc: rsyslog-users <rsyslog@lists.adiscon.com>
Subject: Re: [rsyslog] ruleset name as variable

full config pls

El mar., 2 jul. 2019 a las 14:13, Naoum, A. (Alexandros)
(<alexandros.naoum@nn.cz>) escribió:
>
>
>
> That sound better but I'm not sure if I done it correct because doesn't work.
>
> I put this line before the ruleset definition:
>
> set $!sourcetype = "syslog_checkpoint_test";
>
> I have a template:
>
> template(name="DynIPFile_test" type="string" string="/var/log/logs/%$!sourcetype%/%FROMHOST-IP%/%FROMHOST-IP%.log")
>
> In the action I have this:
>
> action(name="action_syslog_checkpoint2"
> type="omfile"
> DynaFile="DynIPFile_test")
>
> Regards,
> Alexandros
>
> -----Original Message-----
> From: Rainer Gerhards <rgerhards@hq.adiscon.com>
> Sent: Tuesday, July 2, 2019 1:18 PM
> To: Naoum, A. (Alexandros) <alexandros.naoum@nn.cz>
> Cc: rsyslog-users <rsyslog@lists.adiscon.com>
> Subject: Re: [rsyslog] ruleset name as variable
>
> El mar., 2 jul. 2019 a las 13:15, Naoum, A. (Alexandros)
> (<alexandros.naoum@nn.cz>) escribió:
> >
> >
> > Thank you for the reply.
> >
> > It is a good way but in my scenario... probably will not provide what I want to get.
> > I want to reuse this variable as part of the file name on omfile module in multiple rulesets (different sources in each).
>
> variables are NOT local to rulesets. If you do not need a stack, you can just use
>
> set $.rsname="name";
> and use that in the template. That's it.
>
> Rainer
> >
> > So instead of having multiple templates with static parts/names I want to use one template that will get a part of the file name from the ruleset (or from the actual .conf file).
> >
> >
> This message (including any attachments) may contain confidential information. It is intended for use by the recipient only. Any dissemination, copying or distribution to third parties without the express consent of the sender is strictly prohibited. If you have received this message in error, please delete it immediately and notify the sender. Thank you for your collaboration.
This message (including any attachments) may contain confidential information. It is intended for use by the recipient only. Any dissemination, copying or distribution to third parties without the express consent of the sender is strictly prohibited. If you have received this message in error, please delete it immediately and notify the sender. Thank you for your collaboration.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: ruleset name as variable [ In reply to ]
you define it outside of the ruleset! So it is only executed when the
default ruleset is executed. Move it into the ruleset. That's exactly
why I needed the full config ;-)

Rainer

El mar., 2 jul. 2019 a las 14:20, Naoum, A. (Alexandros)
(<alexandros.naoum@nn.cz>) escribió:
>
>
> set $!sourcetype = "syslog_checkpoint_ids_test";
> template(name="DynIPFile" type="string" string="/var/log/logs/syslog_checkpoint_ids/%FROMHOST-IP%/%FROMHOST-IP%.log")
> template(name="DynIPFile_test" type="string" string="/var/log/logs/%$!sourcetype%/%FROMHOST-IP%/%FROMHOST-IP%.log")
> ruleset(name="syslog_checkpoint_ids"
> queue.type="Direct"
> queue.timeoutenqueue="0")
> {
> if $fromhost-ip == [
> "15.112.10.6",
> "15.112.10.5",
> "15.112.10.4",
> ]
> then {
> action(name="action_syslog_checkpoint"
> type="omfile"
> DynaFile="DynIPFile")
> action(name="action_syslog_checkpoint2"
> type="omfile"
> DynaFile="DynIPFile_test")
>
> stop
> }
> }
>
>
> Regards,
> Alexandros
>
> -----Original Message-----
> From: Rainer Gerhards <rgerhards@hq.adiscon.com>
> Sent: Tuesday, July 2, 2019 2:16 PM
> To: Naoum, A. (Alexandros) <alexandros.naoum@nn.cz>
> Cc: rsyslog-users <rsyslog@lists.adiscon.com>
> Subject: Re: [rsyslog] ruleset name as variable
>
> full config pls
>
> El mar., 2 jul. 2019 a las 14:13, Naoum, A. (Alexandros)
> (<alexandros.naoum@nn.cz>) escribió:
> >
> >
> >
> > That sound better but I'm not sure if I done it correct because doesn't work.
> >
> > I put this line before the ruleset definition:
> >
> > set $!sourcetype = "syslog_checkpoint_test";
> >
> > I have a template:
> >
> > template(name="DynIPFile_test" type="string" string="/var/log/logs/%$!sourcetype%/%FROMHOST-IP%/%FROMHOST-IP%.log")
> >
> > In the action I have this:
> >
> > action(name="action_syslog_checkpoint2"
> > type="omfile"
> > DynaFile="DynIPFile_test")
> >
> > Regards,
> > Alexandros
> >
> > -----Original Message-----
> > From: Rainer Gerhards <rgerhards@hq.adiscon.com>
> > Sent: Tuesday, July 2, 2019 1:18 PM
> > To: Naoum, A. (Alexandros) <alexandros.naoum@nn.cz>
> > Cc: rsyslog-users <rsyslog@lists.adiscon.com>
> > Subject: Re: [rsyslog] ruleset name as variable
> >
> > El mar., 2 jul. 2019 a las 13:15, Naoum, A. (Alexandros)
> > (<alexandros.naoum@nn.cz>) escribió:
> > >
> > >
> > > Thank you for the reply.
> > >
> > > It is a good way but in my scenario... probably will not provide what I want to get.
> > > I want to reuse this variable as part of the file name on omfile module in multiple rulesets (different sources in each).
> >
> > variables are NOT local to rulesets. If you do not need a stack, you can just use
> >
> > set $.rsname="name";
> > and use that in the template. That's it.
> >
> > Rainer
> > >
> > > So instead of having multiple templates with static parts/names I want to use one template that will get a part of the file name from the ruleset (or from the actual .conf file).
> > >
> > >
> > This message (including any attachments) may contain confidential information. It is intended for use by the recipient only. Any dissemination, copying or distribution to third parties without the express consent of the sender is strictly prohibited. If you have received this message in error, please delete it immediately and notify the sender. Thank you for your collaboration.
> This message (including any attachments) may contain confidential information. It is intended for use by the recipient only. Any dissemination, copying or distribution to third parties without the express consent of the sender is strictly prohibited. If you have received this message in error, please delete it immediately and notify the sender. Thank you for your collaboration.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: ruleset name as variable [ In reply to ]
Perfect, that works. I was hesitating to add staff inside the ruleset but it was what needed

Thank you a lot!


Regards,
Alexandros

-----Original Message-----
From: Rainer Gerhards <rgerhards@hq.adiscon.com>
Sent: Tuesday, July 2, 2019 2:24 PM
To: Naoum, A. (Alexandros) <alexandros.naoum@nn.cz>
Cc: rsyslog-users <rsyslog@lists.adiscon.com>
Subject: Re: [rsyslog] ruleset name as variable

you define it outside of the ruleset! So it is only executed when the default ruleset is executed. Move it into the ruleset. That's exactly why I needed the full config ;-)

Rainer

El mar., 2 jul. 2019 a las 14:20, Naoum, A. (Alexandros)
(<alexandros.naoum@nn.cz>) escribió:
>
>
> set $!sourcetype = "syslog_checkpoint_ids_test";
> template(name="DynIPFile" type="string"
> string="/var/log/logs/syslog_checkpoint_ids/%FROMHOST-IP%/%FROMHOST-IP
> %.log") template(name="DynIPFile_test" type="string"
> string="/var/log/logs/%$!sourcetype%/%FROMHOST-IP%/%FROMHOST-IP%.log")
> ruleset(name="syslog_checkpoint_ids"
> queue.type="Direct"
> queue.timeoutenqueue="0")
> {
> if $fromhost-ip == [
> "15.112.10.6",
> "15.112.10.5",
> "15.112.10.4",
> ]
> then {
> action(name="action_syslog_checkpoint"
> type="omfile"
> DynaFile="DynIPFile")
> action(name="action_syslog_checkpoint2"
> type="omfile"
> DynaFile="DynIPFile_test")
>
> stop
> }
> }
>
>
> Regards,
> Alexandros
>
> -----Original Message-----
> From: Rainer Gerhards <rgerhards@hq.adiscon.com>
> Sent: Tuesday, July 2, 2019 2:16 PM
> To: Naoum, A. (Alexandros) <alexandros.naoum@nn.cz>
> Cc: rsyslog-users <rsyslog@lists.adiscon.com>
> Subject: Re: [rsyslog] ruleset name as variable
>
> full config pls
>
> El mar., 2 jul. 2019 a las 14:13, Naoum, A. (Alexandros)
> (<alexandros.naoum@nn.cz>) escribió:
> >
> >
> >
> > That sound better but I'm not sure if I done it correct because doesn't work.
> >
> > I put this line before the ruleset definition:
> >
> > set $!sourcetype = "syslog_checkpoint_test";
> >
> > I have a template:
> >
> > template(name="DynIPFile_test" type="string"
> > string="/var/log/logs/%$!sourcetype%/%FROMHOST-IP%/%FROMHOST-IP%.log
> > ")
> >
> > In the action I have this:
> >
> > action(name="action_syslog_checkpoint2"
> > type="omfile"
> > DynaFile="DynIPFile_test")
> >
> > Regards,
> > Alexandros
> >
> > -----Original Message-----
> > From: Rainer Gerhards <rgerhards@hq.adiscon.com>
> > Sent: Tuesday, July 2, 2019 1:18 PM
> > To: Naoum, A. (Alexandros) <alexandros.naoum@nn.cz>
> > Cc: rsyslog-users <rsyslog@lists.adiscon.com>
> > Subject: Re: [rsyslog] ruleset name as variable
> >
> > El mar., 2 jul. 2019 a las 13:15, Naoum, A. (Alexandros)
> > (<alexandros.naoum@nn.cz>) escribió:
> > >
> > >
> > > Thank you for the reply.
> > >
> > > It is a good way but in my scenario... probably will not provide what I want to get.
> > > I want to reuse this variable as part of the file name on omfile module in multiple rulesets (different sources in each).
> >
> > variables are NOT local to rulesets. If you do not need a stack, you
> > can just use
> >
> > set $.rsname="name";
> > and use that in the template. That's it.
> >
> > Rainer
> > >
> > > So instead of having multiple templates with static parts/names I want to use one template that will get a part of the file name from the ruleset (or from the actual .conf file).
> > >
> > >
> > This message (including any attachments) may contain confidential information. It is intended for use by the recipient only. Any dissemination, copying or distribution to third parties without the express consent of the sender is strictly prohibited. If you have received this message in error, please delete it immediately and notify the sender. Thank you for your collaboration.
> This message (including any attachments) may contain confidential information. It is intended for use by the recipient only. Any dissemination, copying or distribution to third parties without the express consent of the sender is strictly prohibited. If you have received this message in error, please delete it immediately and notify the sender. Thank you for your collaboration.
This message (including any attachments) may contain confidential information. It is intended for use by the recipient only. Any dissemination, copying or distribution to third parties without the express consent of the sender is strictly prohibited. If you have received this message in error, please delete it immediately and notify the sender. Thank you for your collaboration.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: ruleset name as variable [ In reply to ]
El mar., 2 jul. 2019 a las 14:42, Naoum, A. (Alexandros)
(<alexandros.naoum@nn.cz>) escribió:
>
>
>
> Perfect, that works. I was hesitating to add staff inside the ruleset but it was what needed

you need to be aware that "set" is actually an action, something that
performs work. It's not purely declarative (like templates). Anything
that performs work needs to go into where this work has to be
performed.

Rainer
>
> Thank you a lot!
>
>
> Regards,
> Alexandros
>
> -----Original Message-----
> From: Rainer Gerhards <rgerhards@hq.adiscon.com>
> Sent: Tuesday, July 2, 2019 2:24 PM
> To: Naoum, A. (Alexandros) <alexandros.naoum@nn.cz>
> Cc: rsyslog-users <rsyslog@lists.adiscon.com>
> Subject: Re: [rsyslog] ruleset name as variable
>
> you define it outside of the ruleset! So it is only executed when the default ruleset is executed. Move it into the ruleset. That's exactly why I needed the full config ;-)
>
> Rainer
>
> El mar., 2 jul. 2019 a las 14:20, Naoum, A. (Alexandros)
> (<alexandros.naoum@nn.cz>) escribió:
> >
> >
> > set $!sourcetype = "syslog_checkpoint_ids_test";
> > template(name="DynIPFile" type="string"
> > string="/var/log/logs/syslog_checkpoint_ids/%FROMHOST-IP%/%FROMHOST-IP
> > %.log") template(name="DynIPFile_test" type="string"
> > string="/var/log/logs/%$!sourcetype%/%FROMHOST-IP%/%FROMHOST-IP%.log")
> > ruleset(name="syslog_checkpoint_ids"
> > queue.type="Direct"
> > queue.timeoutenqueue="0")
> > {
> > if $fromhost-ip == [.
> > "15.112.10.6",
> > "15.112.10.5",
> > "15.112.10.4",
> > ]
> > then {
> > action(name="action_syslog_checkpoint"
> > type="omfile"
> > DynaFile="DynIPFile")
> > action(name="action_syslog_checkpoint2"
> > type="omfile"
> > DynaFile="DynIPFile_test")
> >
> > stop
> > }
> > }
> >
> >
> > Regards,
> > Alexandros
> >
> > -----Original Message-----
> > From: Rainer Gerhards <rgerhards@hq.adiscon.com>
> > Sent: Tuesday, July 2, 2019 2:16 PM
> > To: Naoum, A. (Alexandros) <alexandros.naoum@nn.cz>
> > Cc: rsyslog-users <rsyslog@lists.adiscon.com>
> > Subject: Re: [rsyslog] ruleset name as variable
> >
> > full config pls
> >
> > El mar., 2 jul. 2019 a las 14:13, Naoum, A. (Alexandros)
> > (<alexandros.naoum@nn.cz>) escribió:
> > >
> > >
> > >
> > > That sound better but I'm not sure if I done it correct because doesn't work.
> > >
> > > I put this line before the ruleset definition:
> > >
> > > set $!sourcetype = "syslog_checkpoint_test";
> > >
> > > I have a template:
> > >
> > > template(name="DynIPFile_test" type="string"
> > > string="/var/log/logs/%$!sourcetype%/%FROMHOST-IP%/%FROMHOST-IP%.log
> > > ")
> > >
> > > In the action I have this:
> > >
> > > action(name="action_syslog_checkpoint2"
> > > type="omfile"
> > > DynaFile="DynIPFile_test")
> > >
> > > Regards,
> > > Alexandros
> > >
> > > -----Original Message-----
> > > From: Rainer Gerhards <rgerhards@hq.adiscon.com>
> > > Sent: Tuesday, July 2, 2019 1:18 PM
> > > To: Naoum, A. (Alexandros) <alexandros.naoum@nn.cz>
> > > Cc: rsyslog-users <rsyslog@lists.adiscon.com>
> > > Subject: Re: [rsyslog] ruleset name as variable
> > >
> > > El mar., 2 jul. 2019 a las 13:15, Naoum, A. (Alexandros)
> > > (<alexandros.naoum@nn.cz>) escribió:
> > > >
> > > >
> > > > Thank you for the reply.
> > > >
> > > > It is a good way but in my scenario... probably will not provide what I want to get.
> > > > I want to reuse this variable as part of the file name on omfile module in multiple rulesets (different sources in each).
> > >
> > > variables are NOT local to rulesets. If you do not need a stack, you
> > > can just use
> > >
> > > set $.rsname="name";
> > > and use that in the template. That's it.
> > >
> > > Rainer
> > > >
> > > > So instead of having multiple templates with static parts/names I want to use one template that will get a part of the file name from the ruleset (or from the actual .conf file).
> > > >
> > > >
> > > This message (including any attachments) may contain confidential information. It is intended for use by the recipient only. Any dissemination, copying or distribution to third parties without the express consent of the sender is strictly prohibited. If you have received this message in error, please delete it immediately and notify the sender. Thank you for your collaboration.
> > This message (including any attachments) may contain confidential information. It is intended for use by the recipient only. Any dissemination, copying or distribution to third parties without the express consent of the sender is strictly prohibited. If you have received this message in error, please delete it immediately and notify the sender. Thank you for your collaboration.
> This message (including any attachments) may contain confidential information. It is intended for use by the recipient only. Any dissemination, copying or distribution to third parties without the express consent of the sender is strictly prohibited. If you have received this message in error, please delete it immediately and notify the sender. Thank you for your collaboration.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.