I'm curious why *omelasticsearch* doesn't support a dynamic *template*, please?
It can be very useful when a single message should be sent to multiple *omelasticsearch* outputs (handling different clusters) with different content and with *retryfailures.* *Reason #1:* rsyslogd doesn't support cloning messages for further altering: - the *action.copyMsg* is for actions, not for rulesets - *omruleset* is deprecated - *call* doesn't support *copyMsg* *Reason #2*: *omelasticsearch* *retryfailures* always set the message to *$!* only The needed over-complicated result, requiring different actions for the first try and retries only because of the different action templates: - the main ruleset has to prepare trees *$!out1* and *$!out2* - the main ruleset runs *action(type="omelasticsearch" template="subtree_from_out1" retryRuleset="out1_retry" server="S1" ...)* - the main ruleset runs *action(type="omelasticsearch" template="subtree_from_out2" retryRuleset="out2_retry"server="S2" ...)* - the ruleset *out1_retry* runs *action(type="omelasticsearch" template="subtree_from_root" retryRuleset="out1_retry" server="S1" ...)* - the ruleset *out2_retry* runs *action(type="omelasticsearch" template="subtree_from_root" retryRuleset="out2_retry" server="S2" ...)* Thanks Jake _______________________________________________ rsyslog mailing list https://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
