Mailing List Archive

Fwd: Dynamic template in omelasticsearch?
I'm curious why *omelasticsearch* doesn't support a dynamic *template*,
please?

It can be very useful when a single message should be sent to multiple
*omelasticsearch* outputs (handling different clusters) with different
content and with *retryfailures.*

*Reason #1:* rsyslogd doesn't support cloning messages for further altering:

- the *action.copyMsg* is for actions, not for rulesets
- *omruleset* is deprecated
- *call* doesn't support *copyMsg*

*Reason #2*: *omelasticsearch* *retryfailures* always set the message to
*$!* only

The needed over-complicated result, requiring different actions for the
first try and retries only because of the different action templates:

- the main ruleset has to prepare trees *$!out1* and *$!out2*
- the main ruleset runs *action(type="omelasticsearch"
template="subtree_from_out1" retryRuleset="out1_retry" server="S1" ...)*
- the main ruleset runs *action(type="omelasticsearch"
template="subtree_from_out2" retryRuleset="out2_retry"server="S2" ...)*
- the ruleset *out1_retry* runs *action(type="omelasticsearch"
template="subtree_from_root" retryRuleset="out1_retry" server="S1" ...)*
- the ruleset *out2_retry* runs *action(type="omelasticsearch"
template="subtree_from_root" retryRuleset="out2_retry" server="S2" ...)*

Thanks
Jake
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.