3
responses

Hi,

I am trying to add a custom tag message in front of the logs similar to rsyslog custom tagging, but couldn't find a module on tagging logs.
The solution in te previous forum on tagging didn't work out.

https://nxlog.co/question/4006/nxlog-logstash-using-custom-tags

Solution in that forum : Exec $tag = 'hl7out';

Does custom tagging works for AIX ? Please provide a solution for it to reflect it in forwarded logs.

AskedJuly 1, 2019 - 5:29pm

Answer (1)

The short answer is, yes. Adding fields works for any OS. That is a built-in feature of the language NXLog uses.
The longer answer is: How you incorporate these fields will depend on your configuration.
Some modules will only use $raw_event by default and will need to be transformed or repackaged.

It may be helpful to show some of your config and what you are trying to accomplish.

Comments (2)

  • nkhljaiswal's picture

    Hi, Please find the testing config I applied.

    <Input in>
    Module im_file
    File "/var/log/test/*.log"
    </Input>

    <Output out>
    Module om_udp
    Host 192.169.1.1
    Port 514
    </Output>

    <Route 1>
    Path in => out
    </Route>

    The custom logs are forwarded and logs are received. But I would like to know how tagging is inserted into this code.

  • Zhengshi's picture
    (NXLog)

    Ah, I see. In our configs, the TAG in RFC 3164 is the $SourceName field.
    If you are wanting to convert the event to Syslog (or it is already syslog), you can simply set $SourceName to what you are wanting and then invoke to_syslog_bsd()( requires xm_syslog).
    This should create an event with the field you are looking for.

    https://nxlog.co/documentation/nxlog-user-guide/xm_syslog.html#xm_syslog_config_examples