☰

Rsyslog：使用 Rainerscript 设置日志字段

tag-icon • tag-icon rsyslog
Rsyslog：使用 Rainerscript 设置日志字段

有来自程序（即supervisord）的日志进入rsyslog。他们的消息以 开头" real-program-name rest of the message"，我正在尝试：

  1. 将程序名称设置为，real-program-name而不是supervisord
  2. 从消息中删除程序名称。

我目前正在这样做：

if ($programname == "supervisord") then {
    set $.programname = re_extract($msg, "^ ([^ ]+)", 0, 1, $programname);
    set $.msg = re_extract($msg, "^ [^ ]+ (.+)", 0, 1, $msg);
}

（编辑：我尝试用$!代替，但$.问题相同）

我的配置文件/脚本中的以下行是

if ($programname startswith "real") then {...}

因此日志告诉我 programname 是否实际上已被 real-program-name 替换

日志显示：

processBATCH: next msg 0: <14>Nov 22 10:51:55 supervisord: real-program-name 127.0.0.1 - - [22/Nov/2017:10:51:55 +0000] "GET /blabla
    IF
        var 'programname'
      ==
        string 'supervisord'
eval expr 0x1a4e0b0, type 'CMP_EQ'
eval expr 0x1a4dcd0, type 'V'
rainerscript: (string) var 17: 'supervisord'
eval expr 0x1a4dcd0, return datatype 'S':0
eval expr 0x1a4e0b0, return datatype 'N':1
if condition result is 1
    SET .programname =
      function 're_extract' (id:8, params:5)
        var 'msg'
        string '^ ([^ ]+)'
        0
        1
        var 'programname'
    END SET
eval expr 0x1a4e270, type 'F'
rainerscript: executing function id 8
eval expr 0x1a4dd00, type 'V'
rainerscript: (string) var 1: ' real-program-name 127.0.0.1 - - [22/Nov/2017:10:51:55 +0000] "GET /blabla" "Mozilla/5.0 (X11; Linux x86_64; rv:57.0) Gecko/20100101 Firefox/57.0"'
eval expr 0x1a4dd00, return datatype 'S':0
eval expr 0x1a4e170, type 'N'
eval expr 0x1a4e170, return datatype 'N':0
eval expr 0x1a4e190, type 'N'
eval expr 0x1a4e190, return datatype 'N':1
re_extract: regexec return is 0
re_extract: regex: end search, found 1
eval expr 0x1a4e270, return datatype 'S':0
    SET .msg =
      function 're_extract' (id:8, params:5)
        var 'msg'
        string '^ [^ ]+ (.+)'
        0
        1
        var 'msg'
    END SET
eval expr 0x1a53290, type 'F'
rainerscript: executing function id 8
eval expr 0x1a534e0, type 'V'
rainerscript: (string) var 1: ' real-program-name 127.0.0.1 - - [22/Nov/2017:10:51:55 +0000] "GET /blabla HTTP/1.0" 200 - "" "Mozilla/5.0 (X11; Linux x86_64; rv:57.0) Gecko/20100101 Firefox/57.0"'
eval expr 0x1a534e0, return datatype 'S':0
eval expr 0x1a53160, type 'N'
eval expr 0x1a53160, return datatype 'N':0
eval expr 0x1a53180, type 'N'
eval expr 0x1a53180, return datatype 'N':1
re_extract: regexec return is 0
re_extract: regex: end search, found 1
eval expr 0x1a53290, return datatype 'S':0
    IF
        var 'programname'
      STARTSWITH
        string 'real'
eval expr 0x1a545f0, type 'CMP_STARTSWITH'
eval expr 0x1a546b0, type 'V'
rainerscript: (string) var 17: 'supervisord'
eval expr 0x1a546b0, return datatype 'S':0
eval expr 0x1a545f0, return datatype 'N':0
if condition result is 0

我的解释是：日志来自主管，正则表达式提取进展顺利，但set没有效果。

我究竟做错了什么 ？

相关内容