Home / server / Questions / 1109137
In Process
Iggy
Asked: 2022-08-26 21:13:24 +0800 CST

Rsyslog server - conditionally forward logs

  • 772

The idea is to receive the logs on the Rsyslog server and then send them to a specific Kafka server depending on the log contents.

For example, Logs are being received on a single port, 514 Forwarding received logs to Kafka topic #1 and lines containing "[warning]" to Kafka topic #2

Is anything like this at all possible?

logging

1 Answers

  1. module(load="omkafka")

*.* action(type="omkafka" topic="topic#1" 
    broker="10.120.169.149:9092"
    confParam=["compression.codec=snappy", "queue.buffering.max.messages=400000"])

if ($msg contains "[warning]") then {
    action(type="omkafka" topic="topic#2" 
    broker="10.120.169.149:9092"
    confParam=["compression.codec=snappy", "queue.buffering.max.messages=400000"])
}
    • 1