Clever Geek Handbook

Change the msg property to a new value using rsyslog

I have this rsyslog config:

    $template f_x,"/path/%programname%.%$YEAR%%$MONTH%%$DAY%%$HOUR%.log"

    if $programname == 'xyz' and $msg contains 'Hello World' or $msg contains 'FATAL'         
    then $msg = 'Starting xyz' ?f_x
    & ~

How can I change this configuration to get the $ msg property from "Hello World" to $ msg = 'BlaBlaBla' and write to file (% programname%.% $ YEAR %% $ MONTH %% $ DAY %% $ HOUR%. log) last value $ msg

Thank you in advance

+3


source to share


1 answer


You cannot override the property msg

.

As of rsyslog 7, you can do the trick using CEE / lumberjack properties with a custom template. Here's an example:



# Notice the use of $!msg in template string
template(name="logline" type="string"
         string="%TIMESTAMP:::date-rfc3339% %HOSTNAME% %syslogtag%%$!msg:::sp-if-no-1st-sp%%msg:::drop-last-lf%\n")

# If the message matches your conditions, set $!msg to your custom string
if ($programname == 'xyz' and $msg contains 'Hello World' or $msg contains 'FATAL') then set $!msg = "Starting xyz";
# Otherwise, use the msg property value
else set $!msg = $msg;

# Finally, use the custom template
action(type="omfile" file="/tmp/logfile" template="logline")

For more information about CEE / lumberjack properties in rsyslog see http://www.rsyslog.com/how-to-set-variables-in-rsyslog-v7/ .

+4


source






More articles:


All Articles