Sample Header Ad - 728x90

rsyslog dynaFile file name from part of received message

0 votes
1 answer
30 views
I'm using python logging library to write to log file. Currently It write to a static file, and contain:
myapp; 2025-06-25 05:44:38 INFO builtins  Hello world
I'm new to rsyslog. How to set rsyslog templates to: 1. Extract the value of first word before first semi-colon and use it as 'key' 2. Write to local log file with the name of key.log (i.e: myapp.log) 3. And when writing, only start from the timestamp to the rest. tried
template(name="debug_format" type="string" string="rawmsg=%rawmsg%, key=%$.key%, msg=%$.msg%\n")

action(type="omfile" file="/home/bino/Documents/playsyslog/debug.log" template="debug_format")

set $.key = field($rawmsg, 1, ";");
set $.key = replace($$.key, "", "");

set $.msg = field($rawmsg, 2, ";");

action(type="omfile" file="/dev/null")
But debug.log only contain
rawmsg=myapp; 2025-06-25 07:40:39 INFO builtins  hello world 1750837239.561345, key=, msg=
empty key and msg ----------Edit------ After i make another observasion with running rsyslogd in debug mode, found that the raw msg received by rsyslog is
9319.712852011:main Q:Reg/w0  : ruleset.c: processBATCH: next msg 0: KEYFIELD; 2025-07-01 00:21:59 INFO to_sock handle Hello there 1751329319.712039
So adapting the help by @meuh at https://unix.stackexchange.com/a/797500/480724 both the 'key' 'part' got
'***FIELD NOT FOUND***'
Asked by Bino Oetomo (103 rep)
Jun 25, 2025, 05:51 AM
Last activity: Jul 1, 2025, 06:17 AM