If else for HOST | Log collection solutions

#1 aaronsssya 7 years ago

Hi, Deu to we have multiple collector of GrayLog in multiple locations. I was thinking could I use if else to send log? for example:

<Output out_wineventlog>
  Module      om_udp
  EXEC   if      $location =~ /^(us)/\
                 {\
                   $collector = 'collector.test.us';\
                 }\
         else\
                 {\
                   $collector = 'collector.test.eu';\
                 }
  Host        $collector
  Port        15001
  OutputType  GELF
</Output>

I have tried many statement, but all failure. E.g. string($collector), "$collector", {$collector}, (EXEC $collector;)..etc.

I always got the following error. ERROR apr_sockaddr_info failed for [$GLogCollector]:15001; No such host is known.

If I config the 'collector.test.us' for Host of output, I can see the $collector is working.

Permalink

#2 b0ti Nxlog ✓ 7 years ago

#1 aaronsssya

Hi, Deu to we have multiple collector of GrayLog in multiple locations. I was thinking could I use if else to send log? for example: <Output out_wineventlog> Module om_udp EXEC if $location =~ /^(us)/\ {\ $collector = 'collector.test.us';\ }\ else\ {\ $collector = 'collector.test.eu';\ } Host $collector Port 15001 OutputType GELF </Output> I have tried many statement, but all failure. E.g. string($collector), "$collector", {$collector}, (EXEC $collector;)..etc. I always got the following error. ERROR apr_sockaddr_info failed for [$GLogCollector]:15001; No such host is known. If I config the 'collector.test.us' for Host of output, I can see the $collector is working.

You can do this with filtering as follows:

<Output out_us>
  Module om_udp
  ...
  Exec $location !~ /^(us)/  drop();
</Output>

<Output out_eu>
  Module om_udp
  ...
  Exec $location !~ /^(eu)/  drop();
</Output>

<Route 66>
  in => out_us, out_eu
</Route>