On Sat, 24 Feb 2024, Mariusz Kruk via rsyslog wrote:
On 23.02.2024 20:29, Frank Morawietz via rsyslog wrote:
You could also just do your own field based on the $fromhost value, just
split at first dot.
set $.loghost=field($hostname,46,1);
Then you can use the $.loghost variable in your template.
Got it. I already tried this adaption of my template and it's looking like
I wanted now!
One thing though. As far as I remember, if your receiver cannot resolve the
hostname, your $fromhost will be identical to $fromhost-ip.
So trimming it after first dot will yield unwanted results.
correct
P.S.: So the global option PreserveFQDN is not used on the receiving
server?
Honestly - have no idea. I don't use it :-)
I think that has to do with the local hostname for the logs it sends, but I
don't remember.
lots of log analysis stuff breaks if the short hostname isn't unique, so while
you can frequently get away with using a FQDN and not having the short name be
unique, it is likely bite you at some point. Best to avoid it.
David Lang
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
