ommongodb default template

[rsyslog]

ommongodb default template

[gcaracuel]

no one could provide me the template used by ommondb?

Thanks!

[rgerhards]

There is no default template, by default MongoDB uses the message passing interface and extracts properties from the message itself.

[gcaracuel]

I'm refering the canned template from documentation http://www.rsyslog.com/doc/ommongodb.html I want to try a custom template but the canned that's indicated on documentation fails.

[rgerhards]

Mhh, I don't know where this doc item stems back to. Maybe we had this template in the early days, but right now there is no default template, the code picks up the properties from the message object, as I said. I'll fix the doc ASAP.

[gcaracuel]

Ok no problem. Finally I got it working with:

template(name="JSON" type="list" option.json="on"){
property(name="hostname" outname="sys")
property(name="timereported" dateformat="rfc3339" outname="time")
property(name="timegenerated" dateformat="rfc3339" outname="time_rcv")
property(name="msg" outname="msg")
property(name="syslogfacility" outname="syslog_fac")
property(name="syslogseverity" outname="syslog_sever")
property(name="syslogtag" outname="syslog_tag")
property(name="programname" outname="procid")
property(name="procid" outname="pid")
property(name="syslogpriority-text" outname="level")
}

This template could be easily fixed.

Thank you so much for your help.

[gcaracuel]

I was wrong, that's not working because dates and integer must to be formatted as integer/date to work with LogAnalyzer for example.

Any idea how to force format it in a template?

I'm inspecting the code at https://github.com/rsyslog/rsyslog/blob/master/plugins/ommongodb/ommongodb.c to find anything else than hard modify custom template and recompile. Cannot recompile on production....

[rgerhards]

There is a pull request to provide a specifc mongodb format. It's a bit
tricky, thus it's not yet merged. What exactly is your use case to change
the template?

On Wed, May 7, 2014 at 5:26 PM, Guillermo Caracuel <[email protected]

wrote:

I was wrong, that's not working because dates and integer must to be
formatted as integer/date to work with LogAnalyzer for example.

Any idea how to force format it in a template?

I'm inspecting the code at
https://github.com/rsyslog/rsyslog/blob/master/plugins/ommongodb/ommongodb.cto find anything else than hard modify custom template and recompile.
Cannot recompile on production....

—
Reply to this email directly or view it on GitHubhttps://github.com//issues/60#issuecomment-42441498
.

[gcaracuel]

I need to add to the default template some other fields, for example: fromhost property and in a near future some other parameters that will be relayed from another rsyslog server acting as tags.

[gcaracuel]

I'm still needing this. Any update Rainer?

Thank you so much.

[rgerhards]

sorry, no time at the moment..

On Wed, Jun 4, 2014 at 9:32 AM, Guillermo Caracuel <[email protected]

wrote:

I'm still needing this. Any update Rainer?

Thank you so much.

—
Reply to this email directly or view it on GitHub
#60 (comment).

[gcaracuel]

I tried https://github.com/eczema/rsyslog/tree/v7-stable and it's working perfect. Hate to compile and to downgrade to v7 but...

[gcaracuel]

After test and adapt code from @eczema I pulled my own request on master branch.

[lock]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.