2
responses

Hi, Deu to we have multiple collector of GrayLog in multiple locations. I was thinking could I use if else to send log? for example:

<Output out_wineventlog>
  Module      om_udp
  EXEC   if      $location =~ /^(us)/\
                 {\
                   $collector = 'collector.test.us';\
                 }\
         else\
                 {\
                   $collector = 'collector.test.eu';\
                 }
  Host        $collector
  Port        15001
  OutputType  GELF
</Output>

I have tried many statement, but all failure. E.g. string($collector), "$collector", {$collector}, (EXEC $collector;)..etc.

I always got the following error. ERROR apr_sockaddr_info failed for [$GLogCollector]:15001; No such host is known.

If I config the 'collector.test.us' for Host of output, I can see the $collector is working.

AskedDecember 1, 2017 - 3:00am

Answer (1)

You can do this with filtering as follows:

<Output out_us>
  Module om_udp
  ...
  Exec $location !~ /^(us)/  drop();
</Output>

<Output out_eu>
  Module om_udp
  ...
  Exec $location !~ /^(eu)/  drop();
</Output>

<Route 66>
  in => out_us, out_eu
</Route>

Comments (1)

  • aaronsssya's picture

    Hi b0ti, Thank you. It is working. I adjusted as the following