Question

I've got rsyslog v7.4.5 writing to MongoDB, and would now like to dynamically set the collection name based on the current hour. I've tried reading their online documentation, however am unclear on which syntax to use for this scenario. I'm basically using the configuration they provide in their example here: http://www.rsyslog.com/tag/ommongodb/

My config is:

input(type="imuxsock" socket="/dev/log")

template(name="mongodblocal" type="subtree" subtree="$!")

if $syslogfacility-text == 'local0' then {
    action(type="mmjsonparse")
    if $parsesuccess == "OK" then {
        # set vars that are appended onto the doc that's written to MongoDB
        set $!time = $timestamp;
        set $!sys = $hostname;
        set $!procid = $syslogtag;
        set $!syslog_fac = $syslogfacility;
        set $!syslog_sever = $syslogpriority;
        set $!pid = $procid;

        action(type="ommongodb" server="127.0.0.1" db="logs" collection="syslog" template="mongodblocal")
    }
}

Note the action where you specify the MongoDB database and collection names:

action(type="ommongodb" server="127.0.0.1" db="logs" collection="syslog" template="mongodblocal")

I'd like to use rsyslog properties to dynamically set the collection name, like this:

action(type="ommongodb" server="127.0.0.1" db="logs" collection="syslog%YEAR%%MONTH%%DAY%%HOUR%" template="mongodblocal")

However, that apparently isn't the right syntax, as the property names are being interpreted as literal strings.

I also tried this, which causes the MongoDB logging to no longer work:

set $!collection = "syslog%YEAR%%MONTH%%DAY%%HOUR%";
action(type="ommongodb" server="127.0.0.1" db="logs" collection="$!collection" template="mongodblocal")

Does anyone know the appropriate syntax to accomplish this?

Was it helpful?

Solution

I posted this question on the developer's forum, and they replied that it is not currently possible to customize the collection name parameter using property values:

http://kb.monitorware.com/rsyslog-ommongodb-syntax-for-dynamic-collection-name-t12161.html

Licensed under: CC-BY-SA with attribution
Not affiliated with StackOverflow
scroll top