rsyslog templates with custom variables doesnt work

48 Views Asked by At

# The imjournal module bellow is now used as a message source instead of imuxsock.
$ModLoad imuxsock # provides support for local system logging (e.g. via logger command)
$ModLoad imjournal # provides access to the systemd journal

# Provides UDP syslog reception
$ModLoad imudp
$UDPServerRun 514
#### GLOBAL DIRECTIVES ####
$DebugFile rsyslogdebug
$DebugLevel 1
# Where to place auxiliary files
$WorkDirectory /var/lib/rsyslog

$IncludeConfig /etc/rsyslog.d/*.conf

# File to store the position in the journal
$IMJournalStateFile imjournal.state

$ModLoad omlibdbi
$ActionLibdbiDriverDirectory /usr/lib64/rsyslog/
$ActionLibdbiDriver Oracle
$ActionLibdbiHost 1.2.3.4
$ActionLibdbiUserName TEST
$ActionlibdbiPassword Password
$ActionlibdbiDBName TRY


if ($syslogtag contains "Limit" or $syslogtag contains 'limit' ) then
{
  set $.incoming = field($msg,44,5);
  set $.outgoing = field($msg,44,6);

  set $.state = 'over limit';
  set $.package_category = field($msg,",",3);
  set $.subscriber_id!field = field($msg,",",2);
$template StdSQLFormat, "INSERT INTO subscriber_event (FROM_HOST ,SUBSCRIBER_ID ,PACKAGE_CATEGORY ,STATE ,INCOMING ,OUTGOING ,STATUS_NOTIFY ,FAILURE_CAUSE_NOTIFY ,RETRY_COUNT) VALUES ('%fromhost-ip%', '%$.subscriber_id%, '%$.package_category%', '%$.state%', '%$.incoming%','%$.outgoing%','10','','0')",stdSQL

}
:omlibdbi:;StdSQLFormat

my configuration file is as this. When i send the rsyslog over 514 port for testing, i can write only, hostname,status_notify and retry count fields. I can not insert my custom variables, why they are not working, i couln't find the problem . Bacause also there is no error on debug mode.

i expect that when i send test log as below, i try to see the fields that i send on database. echo -n " <187>SMS,097@mil,ABC1,80 lim,51,21\n" | nc -4u -w1 127.0.0.1 514

0

There are 0 best solutions below