I have the following dict:
syslog_clients:
mailout:
hosts: “[ ‘10.5.10.111’, ‘10.5.10.112’, ‘10.5.10.11’ ]”
destinations:
- destination: ‘/logs/mail/mail.log’
apache:
hosts: “[ ‘10.5.13.24’, ‘10.5.13.25’, ‘10.5.13.26’ ]”
destinations:
- var: ‘$syslogtag’
contains: ‘apache-access:’
destination: ‘/logs/web/access.log’- var: ‘$syslogtag’
contains: ‘apache-error:’
destination: ‘/logs/web/error.log’
Required output:
if $fromhost-ip == [ “10.5.10.111”, “10.5.10.112”, “10.5.10.11” ] then /logs/mail/mail.log
& stopif $fromhost-ip == [ ‘10.5.13.24’, ‘10.5.13.25’, ‘10.5.13.26’ ] then {
if $syslogtag contains ‘apache-access:’ then /logs/web/access.log
& stop
else if $syslogtag contains ‘apache-error:’ then /logs/web/error.log
& stop
else /logs/web/other.log
& stop
}
Above output is a Rsyslog config file. Logs from certain (like apache) syslog-clients
need to have the variable ‘$syslogtag’ evaluated, while from some (like mailout) need not. I need to have a Jinja2 template that fits both the types of syslog-clients
.
Thank you.