<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from rtf -->
<style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<font face="Calibri, sans-serif" size="2">
<div>Hello all,</div>
<div> </div>
<div>I started to play using rsyslog/liblognorm a week ago, I’m testing them on a CentOS 6.4 virtual machine, and next packages have been installed from Adiscon repository:</div>
<div>rsyslog-mysql-7.4.1-1.el6.x86_64</div>
<div>rsyslog-mmjsonparse-7.4.1-1.el6.x86_64</div>
<div>rsyslog-7.4.1-1.el6.x86_64</div>
<div>rsyslog-mmnormalize-7.4.1-1.el6.x86_64</div>
<div>rsyslog-udpspoof-7.4.1-1.el6.x86_64</div>
<div>rsyslog-elasticsearch-7.4.1-1.el6.x86_64</div>
<div> </div>
<div>I was reading next link, and now I’m trying to select subsets of messages based on liblognorm tags. </div>
<div><a href="http://blog.gerhards.net/2011/04/log-classification-with-liblognorm.html"><font color="#0000FF"><u>http://blog.gerhards.net/2011/04/log-classification-with-liblognorm.html</u></font></a></div>
<div> </div>
<div>So far, I was able to parse a message using mmnormalize module, and now I want to create outputs based on the liblognorm tag(s).</div>
<div>Is this option supported within rsyslog.conf? Any example how to do it?</div>
<div> </div>
<div>Below my testing files:</div>
<div> </div>
<div>=================================================================</div>
<div><b>rsyslog.conf file:</b></div>
<div>module (load="imudp")</div>
<div>module (load="mmnormalize")</div>
<div>module (load="mmjsonparse")</div>
<div> </div>
<div>input(type="imudp" address="192.168.1.1" port="514" ruleset="test")</div>
<div> </div>
<div>template(name="testFormat" type="string" string="%$!all-json%\n")</div>
<div> </div>
<div>ruleset(name="test") {</div>
<div> action(type="mmnormalize" userawmsg="on" rulebase="/data/syslog/rulebase.rb")</div>
<div> action(type="omfile" file="/data/syslog/test-syslog.log" template="testFormat")</div>
<div>}</div>
<div> </div>
<div><b>rulebase.rb file:</b></div>
<div>rule=<font color="#FF0000"><b>test</b></font>:%date:word% %host:ipv4% : %%ASA-%number0:number%-%number1:number%: Denied ICMP type=%number2:number%, code=%number3:number% from %origin:ipv4% on interface outside</div>
<div> </div>
<div><b>test-syslog.log</b><b> file:</b></div>
<div>{ "origin": "77.2.2.2", "number3": "0", "number2": "8", "number1": "313001", "number0": "3", "host": "0.0.0.0", "date": "2013-06-26T10:47:42+01:00" }</div>
<div> </div>
<div><b>Message:</b></div>
<div>"2013-06-26T10:47:42+01:00 0.0.0.0 : %ASA-3-313001: Denied ICMP type=8, code=0 from 77.2.2.2 on interface outside"</div>
<div>======================================================================</div>
<div> </div>
<div> </div>
<div>Thanks in advance for any help,</div>
<div> </div>
<div><font face="Arial, sans-serif" size="2">Jose Castillo</font></div>
<div><font face="Arial, sans-serif" size="2"> </font></div>
<div> </div>
<div> </div>
</font>
</body>
</html>