Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have my rsyslog configured to send logs from a logfile to a remote host

$InputFileName /var/log/app/app.log
$InputFileTag app
$InputFileSeverity info
$InputFileFacility local7
$InputRunFileMonitor
local7.*@ remoteip

Before sendining the log from app.log I need to filter the content to decide whether to send the log or not.
How can I filter log content before sending?

share|improve this question
    
On what condition? –  Danila Ladner Sep 26 '13 at 22:23
    
if message contains $string then discard else forward to remote ip –  user2284355 Sep 26 '13 at 22:28
    
Is it possible to apply regex to the comparison? –  user2284355 Sep 26 '13 at 22:29
    
I am trying to do this but I am getting syntax errors on syslog start:if $msg contains "192.168.2.99 514" then ~ else local7.* @ip –  user2284355 Sep 26 '13 at 22:38

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.