Hello, i Want to change the value of the syslog severity level depending on the contain of the message.

somethin like..

if message contains the word INFO


AskedAugust 18, 2016 - 11:15am

Answer (1)

There is a similar example in the reference manual that does this, basically you need the following:

        # Now set the severity level to something custom. This defaults to 'INFO' if unset.
        # We can use the following numeric values here which are the standard syslog values:
        # ALERT: 1, CRITICAL: 2, ERROR: 3, WARNING: 4, NOTICE: 5, INFO: 6, DEBUG: 7
        if $raw_event =~ /INFO/ $SyslogSeverityValue = 3;
        else $SyslogSeverityValue = 6;