Thanks for your reply, Mariusz. > Also remember that fromhost and fromhost-ip are from the _connection_. > Hostname is the value from the message (might be completely bonkers if > the source doesn't follow standards).
This is exactly why I switched to FROMHOST. To much messages with junk instead of the hostname. > You could also just do your own field based on the $fromhost value, just > split at first dot. > >set $.loghost=field($hostname,46,1); > >Then you can use the $.loghost variable in your template. Got it. I already tried this adaption of my template and it's looking like I wanted now! Best regards, Frank P.S.: So the global option PreserveFQDN is not used on the receiving server? -- Frank Morawietz IT Systems Administrator Global Computational Chemistry & Biology Healthcare | Discovery Development Technologies Merck Healthcare KGaA | Frankfurter Str. 250 | Postcode: D050/902 | 64293 Darmstadt | Germany This message and any attachment are confidential and may be privileged or otherwise protected from disclosure. If you are not the intended recipient, you must not copy this message or attachment or disclose the contents to any other person. If you have received this transmission in error, please notify the sender immediately and delete the message and any attachment from your system. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not accept liability for any omissions or errors in this message which may arise as a result of E-Mail-transmission or for damages resulting from any unauthorized changes of the content of this message and any attachment thereto. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not guarantee that this message is free of viruses and does not accept liability for any damages caused by any virus transmitted therewith. Click merckgroup.com/disclaimer<https://www.merckgroup.com/en/legal-disclaimer/mail-disclaimer.html> to access the German, French, Spanish, Portuguese, Turkish, Polish and Slovak versions of this disclaimer. Please find our Privacy Statement information by clicking here: merckgroup.com/privacy-statements-by-location<https://www.merckgroup.com/en/privacy-statement/privacy-statements-by-location.html> _______________________________________________ rsyslog mailing list https://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
