1 |
* Stefan G. Weichinger: |
2 |
|
3 |
> Maybe I look into mongodb as well, for example I found this small |
4 |
> howto: https://www.fluentd.org/guides/recipes/maillog-mongodb |
5 |
|
6 |
That looks unnecessarily complicated to me. While you can of course move |
7 |
data from an existing log file into MongoDB, I find configuring syslog |
8 |
to use a MongoDB destination (in addition to your files or as a full |
9 |
replacement) much easier. |
10 |
|
11 |
See [1] section "Storing messages in a MongoDB database". I have also |
12 |
done it with rsyslog, but that took a bit more work. |
13 |
|
14 |
Here's a syslog-ng destination I use. Note that using uri() allows |
15 |
passing parameters to modern MongoDB drivers which the older servers() |
16 |
statement cannot cope with. |
17 |
|
18 |
destination d_mongo { |
19 |
mongodb( |
20 |
uri("mongodb://user:pw@hostname:27017/syslog?authSource=admin&ssl=true") |
21 |
collection("messages") |
22 |
value-pairs( |
23 |
scope("selected-macros" "nv-pairs") |
24 |
pair("DATE", datetime("$UNIXTIME")) |
25 |
pair("PID", int64("$PID")) |
26 |
pair("SEQNUM", int64("$SEQNUM")) |
27 |
exclude("HOST*") |
28 |
exclude("LEGACY*") |
29 |
exclude("SOURCE*") |
30 |
exclude("TAGS") |
31 |
) |
32 |
); |
33 |
}; |
34 |
|
35 |
Values are strings to begin with. This example excludes some values I am |
36 |
not interested in, and performs type conversion on others, for example |
37 |
mapping DATE to MongoDB's date/time data type (see ISODate) and PID to a |
38 |
numeric value. Conversion can of course happen during analysis, but |
39 |
since syslog-ng is smart enough to do it when writing data, I prefer |
40 |
that. |
41 |
|
42 |
[1] https://www.syslog-ng.com/technical-documents/doc/syslog-ng-open-source-edition/3.16/administration-guide/37#TOPIC-956524 |
43 |
|
44 |
-Ralph |