jakshi / loggly_rsyslog_ng Goto Github PK

I got the following error trying to use the loggly_rsyslog_ng LWRP. Does the provider class need to be manually required?

NameError
---------
No resource, method, or local variable named `loggy_rsyslog_ng_tls' for `Chef::Provider::LogglyRsyslogNg ""'


Cookbook Trace:
---------------
/var/lib/aws/opsworks/cache.stage2/cookbooks/loggly_rsyslog_ng/providers/default.rb:38:in `block in class_from_file'

According to https://www.loggly.com/docs/rsyslog-manual-configuration/, rsyslog 7+ should be using a slightly different format:

template(name="LogglyFormat" type="string"
 string="<%pri%>%protocol-version% %timestamp:::date-rfc3339% %HOSTNAME% %app-name% %procid% %msgid% [TOKEN@41058 tag=\"TAG\"] %msg%\n")

# Send messages to Loggly over TCP using the template.
action(type="omfwd" protocol="tcp" target="logs-01.loggly.com" port="514" template="LogglyFormat")

This cookbook only uses the rsyslog 6 format:

$template LogglyFormat,"<%pri%>%protocol-version% %timestamp:::date-rfc3339% %HOSTNAME% %app-name% %procid% %msgid% [TOKEN@41058 tag=\"TAG\"] %msg%\n"

# Send messages to Loggly over TCP using the template.
*.* @@logs-01.loggly.com:514;LogglyFormat

As you note in your readme this does not work with multiple log files...

With these settings:

$InputFileName /mnt/ephemeral/logs/beta.log
$InputFileTag 21logglyappbetaconf:
$InputFileStateFile imfile-state:-mnt-ephemeral-logs-beta.log

this line is generated:
@@logs-01.loggly.com:6514;template-mnt-ephemeral-logs-beta.log

I have 9 files with unique $InputFileTag yet every log entry in loggly is repeated 9 times.

I discovered modifying the template (and all the others) like this:
if $programname == '21logglyappbetaconf' then *.* @@logs-01.loggly.com:6514;template-mnt-ephemeral-logs-beta.log
fixes the repeats. E.g. $programname must match $InputFileTag without the colon.

However, I can't get that to work with the rsyslog selector event though at least some docs hint it may be possible to combine expression based filters with facility based filters. I am happy to submit a pull request but I wanted to ask for your thoughts... Also although my rsyslogd version is 7.4.4 I seem to be using the older template style for some reason...

Thanks!