Multiple use of the same execution block

Post a different question
2
responses

Hi,

 

I've to use the same exec block multiple times in different paths. I've already tried it with a processor module, but unfortunately a processor module could only be used once. A possible solution is to implement them in the input modules, but I've more than one input module (syslog tcp/udp alone are already two) which ends in multiple code in different modules. But I want them once and want to use them multiple times.

Have someone an idea how to implement this?

Thanks in advance.

 

br

 

 

AskedJuly 18, 2017 - 8:58am

Answer (1)

The NXLog Enterprise Edition comes with a module as of version 3.0 called xm_rewrite that you can use for this purpose. Here is a config skeleton to illustrate this:

<Extension rewrite>
    Module      xm_rewrite
    Exec        if $msg =~ /error/ $sev = 'ERROR';
</Extension>

<Input in1>
    Module      im_...
    ...
    Exec        rewrite->process();
</Input>

<Input in2>
    Module      im_...
    ...
    Exec        rewrite->process();
</Input>

The other option would be using define:

define MYRULE if $msg =~ /error/ $sev = 'ERROR';

<Input in1>
    Module      im_...
    ...
    Exec       %MYRULE%
</Input>

<Input in2>
    Module      im_...
    ...
    Exec        %MYRULE%
</Input>
AnsweredJuly 18, 2017 - 11:51am

Comments (1)