4
responses

How would I change the syslog event message on an output module so that every message gets an additional field?  I want to add another value called "Project X" after the message portion of all syslogs events/messages as they are forwarded to another server?  Would I use $raw_event as I show in my example? 

Current config:

<Output out>

   Module om_udp

   Host 192.168.1.10

   Port 514

</Output>

 

Would I do this?

<Output out>

   Module om_udp

   Host 192.168.1.10

   Port 514

   Exec $raw_event = $raw_event + "Project X";

</Output>

 

OR is it more like this...?

<Output Out>

   Module om_udp

   Host 192.168.1.10

   Port 514

   $Message = $Message + "Project X"

   Exec to_syslog_bsd();

</Output out>

 

 

 

AskedJune 6, 2016 - 8:13pm

Answers (2)

I think it is a matter of personal choise.

I usuallly add fields in input modules.

Exec $new_field = 'new field value';

and select the output format with Exec to_* command in output modules.

 

 

Basically both would work but for $Message to be populated in your second method you need to call parse_syslog() first.

Comments (2)

  • bluelotus's picture

    If I use the first method with Exec $raw_event do I need to add a LF at the end so it's now... Exec $raw_event = $raw_event + "Project X" "\n";  

     

  • adm's picture
    (NXLog)

    With UDP it's one syslog message per datagram, no need for the LF. The LF as the record separator/terminator is only needed for TCP but that's added automatically by the module (i.e. om_tcp, om_ssl).