For my use case, yes.
Just build configuration using 'global' templates with configuration
snippets and this just simplify the things.
One of the forward action as example:
root@syslog:/etc/rsyslog-global/host/lin/forwards# ls -la 11*
lrwxrwxrwx 1 root root 51 Sep 19 14:13 111-fwd-esparser03-lin-target.conf
-> ../../../lin/includes/fwd-esparser03-lin-target.inc
lrwxrwxrwx 1 root root 47 Sep 19 14:13 112-fwd-esparser03-lin-queue.conf ->
../../../global/includes/fwd-queue-1k-large.inc
lrwxrwxrwx 1 root root 48 Sep 19 14:13 113-fwd-esparser03-lin-template.conf
-> ../../../global/includes/fwd-template-relay2.inc
root@syslog:/etc/rsyslog-global/host/lin/forwards# cat
111-fwd-esparser03-lin-target.conf
action(type="omfwd" protocol="tcp" target="10.0.0.3" port="2514"
name="ESP03"
queue.FileName="fq_esp03"
root@syslog:/etc/rsyslog-global/host/lin/forwards# cat
112-fwd-esparser03-lin-queue.conf
queue.spoolDirectory="/var/spool/rsyslog"
queue.size="10000000"
queue.MaxDiskSpace="5000m"
queue.Type="LinkedList"
queue.HighWaterMark="500000"
queue.LowWaterMark="400000"
root@syslog:/etc/rsyslog-global/host/lin/forwards# cat
113-fwd-esparser03-lin-template.conf
template="relay2ForwardTemplate"
)
root@syslog:/etc/rsyslog-global/host/lin/forwards# cat 11*
action(type="omfwd" protocol="tcp" target="10.0.0.3" port="2514"
name="ESP03"
queue.FileName="fq_esp03"
queue.spoolDirectory="/var/spool/rsyslog"
queue.size="10000000"
queue.MaxDiskSpace="5000m"
queue.Type="LinkedList"
queue.HighWaterMark="500000"
queue.LowWaterMark="400000"
template="relay2ForwardTemplate"
)
Creating 110-fwd-filter.conf file with simple 'if property' check make the
filter and action work as expected.
On Thu, Sep 19, 2019 at 4:41 PM ???? ???????? via rsyslog <
rsyslog@lists.adiscon.com> wrote:
> Is there any sense to not use brackets always?
>
> On 19/09/2019 17:36, Peter Viskup via rsyslog wrote:
> > Want to be sure the following configurations are the same
> >
> > if $hostname contains "text" then {
> > action(type="omfwd" .....)
> > }
> >
> > and without curly brackets
> >
> > if $hostname contains "text" then
> > action(type="omfwd" ......)
> >
> > The first option with brackets has to be used in case of more actions
> > following the filter.
> > There is only one action following the filter. Is this my
> > assumption correct?
> >
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
> DON'T LIKE THAT.
>
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow
https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.