Skip to content

Instantly share code, notes, and snippets.

@holybit

holybit/gist:a5559faed6db86bc327a

Last active August 29, 2015 14:13
Show Gist options
  • Save holybit/a5559faed6db86bc327a to your computer and use it in GitHub Desktop.
Save holybit/a5559faed6db86bc327a to your computer and use it in GitHub Desktop.
Download ZIP
rsyslog property replacer
Raw
gistfile1.txt
# Logs example below
# I am interested in the APP-NAME (i.e., apache-access_log-foo_bar) of the HEADER
Jan 12 11:19:36 hostx apache-access_log-foo_bar: site=postmaster.dev.returnpath.net ip=10.0.2.81 datetime="2015-01-12 11:19:36 -0700" timestamp=1421086776 host=postmaster.dev.returnpath.net request="GET /assets/font/fontawesome-webfont.woff HTTP/1.1"
# I want to be able to write out the syslog above to a file such that APP-NAME is used for the file name
/tmp/apache-acces_log-foo_bar
# Template
$template APACHE-ACCESS,"/tmp/%SYSLOGTAG%.log"
# Filter
:rawmsg, contains, "apache-access_log" ?APACHE-ACCESS
& stop
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment