How can i use the HOSTNAME from the HEADER Field as Filename

Q & ACategory: QuestionsHow can i use the HOSTNAME from the HEADER Field as Filename
Thomas asked 2 months ago

Hello,
i want to use the “my-local-hostname” as Filename but every trials give me only the ip or the dns-hostname
 
[2017-09-28T10:53:50.409331] Incoming log entry; line='1 2017-09-28T10:53:50.386992+02:00 my-local-hostname APP 54321 111111 - Syslog Test Message'
[2017-09-28T10:53:50.409582] Outgoing message; message='2017-09-28T10:53:50+02:00 10.3.25.4 1 2017-09-28T10:53:50.386992+02:00 my-local-hostname APP 54321 111111 - Syslog Test Message

 
My short config:

@version: 3.9
options { keep_hostname(yes); use_dns(no); use_fqdn(no); chain_hostnames(no); };
source s_system { udp(ip("0.0.0.0") port(514)); };
destination d_all { file("/tmp/$FULLHOST.log"); };
log { source(s_system); destination(d_all); };

 
Thanks for your hints
Thomas
PS the code tag looks crazy

1 Answers
Kokan answered 2 months ago

Hello,
 
You are missing the priority from your message header:

 2017-09-28T10:53:50.386992+02:00 my-local-hostname APP 54321 111111 - Syslog Test Message

If you send this message it is going to work with your configuration.
 

Kokan