filtering - rsyslog7 filter to hostname if no match to regex -
so i'm extremely new rsyslog (recently switch syslog-ng) , can have dynamic filenames... work has started using docker , they're sending lot of fields in syslogtag remote host. instead of setting filters every instance, i'm trying write dynamic filter parse out relevant details , put it's own log/directory such /var/log/docker/app name/syslog.log
i have 'app name' working when they're providing proper delimiters between fields when they're not using proper one, regex returning **no match** , putting '/var/log/docker/**no match**/syslog.log'. using **no match** directory not issue grouping every remote host in 1 file is. there way test if regex returned no match , have change filename 'syslog.log' '%hostname%.log' ?
Comments
Post a Comment