CODEWITHSUNDEEP
templatesrsyslog
Peder Zickler
Peder Zickler

Reputation: 39

Rsyslog Trimming App-Names over 48 Characters

I am trying to trim extra characters over 48 with the following addition, but it doesn't work. What could be wrong?

rsyslog.conf (without change)

$ActionQueueType LinkedList
$ActionQueueFileName srvrfwd
$ActionResumeRetryCount -1
$ActionQueueSaveOnShutdown on
$ModLoad imudp #loads the udp module
$UDPServerAddress XX.XX.YY.ZZ
$UDPServerRun 514
*.* @127.0.0.1:6514;RSYSLOG_SyslogProtocol23Format

rsyslog.conf (with addition)

$ActionQueueType LinkedList
$ActionQueueFileName srvrfwd
$ActionResumeRetryCount -1
$ActionQueueSaveOnShutdown on
$ModLoad imudp #loads the udp module
$UDPServerAddress XX.XX.YY.ZZ
$UDPServerRun 514

set $.APPNAME47 = substring($app-name, 0, 47);

template(name="trimmer" type="string"
     string="<%PRI%>1 %TIMESTAMP:::date-rfc3339% %HOSTNAME% %$.APPNAME47% %PROCID% %MSGID% %STRUCTURED-DATA% %msg%\n")

*.* @127.0.0.1:6514;trimmer

Upvotes: 0

Views: 304

Answers (1)

Peder Zickler
Peder Zickler

Reputation: 39

this worked fine.

template(name="trimmer" type="string" string="<%PRI%>1 %TIMESTAMP:::date-rfc3339% %HOSTNAME% %APP-NAME:1:46% %PROCID% %MSGID% %STRUCTURED-DATA% %msg%\n")

*.* @127.0.0.1:6514;trimmer

Upvotes: 1

Related Questions