Not directly.
"The file being monitored. So far, this must be an absolute name (no
macros or templates). Note that wildcards are supported at the file name
level (see *WildCards* below for more details)." after
https://www.rsyslog.com/doc/v8-stable/configuration/modules/imfile.html
But.
You can use metadata.
https://www.rsyslog.com/doc/v8-stable/configuration/modules/imfile.html#metadata
You can then process that variable to extract the fields you want and
use custom template to replace the tag on output.
At least that's how I'd approach this.
MK
On 28.09.2022 17:11, Brian C. Hill via rsyslog wrote:
Hello,
I'd like to be able use info from the filename to set the tag name
(and maybe other uses).
Where the filename would look like...
/var/log/<env_name>-<app_name>.log
... I'd like to be able to set the Tag= to be <app_name>@<env_name>
I have 3 apps (app1/2/3, each of which exists 3 separate envs
(dev,stg,prod).
That means I need nine permutations:
input( Type="imfile"
File="/var/log/apps/dev-app1.log"
Tag="app1@dev"
Severity="debug"
Facility="local7"
Ruleset="journal"
)
.
.
.
input( Type="imfile"
File="/var/log/apps/prod-app3.log"
Tag="app3@prod"
Severity="debug"
Facility="local7"
Ruleset="journal"
)
I'd like to able to do something like this:
input( Type="imfile"
File="/var/log/apps/%1-%2.log"
Tag="%2@%1"
Severity="debug"
Facility="local7"
Ruleset="journal"
)
It doesn't look like this is possible, but maybe I am missing something.
Am I?
Brian
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST
if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
