I'm trying to concatenate postfix log output with rsyslog directly. This is my template.

template(name="TestMailTemplate" type="list"){
property(name="timestamp" dateFormat="rfc3339")
constant(value=" ")
constant(value=" ")
constant(value=" ")
property(name="msg" regex.expression="([A-Z0-9]{9})" regex.type="ERE" regex.match="0" )
property(name="msg" droplastlf="on" )

Where this property property(name="msg" regex.expression="([A-Z0-9]{9})" regex.type="ERE" regex.match="0" ) outputs the value I want if matched: e.g. 9BDCED186

I would then like to use this to match other log lines, to produce final output. From this:

2019-01-03T17:02:00+00:00 mail2 postfix/pickup[8786]: 9BDCED186 9BDCED186: uid=1004 from=<support@mycompany.com>
2019-01-03T17:02:00+00:00 mail2 postfix/qmgr[27972]: 9BDCED186 9BDCED186: from=<support@mycompany.com>, size=94699, nrcpt=1 (queue active)
2019-01-03T17:02:10+00:00 mail2 postfix/smtp[25428]: 9BDCED186 9BDCED186: to=<someone@otherdomain.com>, relay=mx4.mail.otherdomain.com[*.*.*.*]:25, delay=9.9, delays=0.13/0/6.3/3.4, dsn=2.0.0, status=sent (250 2.0.0 Ok: queued as **********)
2019-01-03T17:02:10+00:00 mail2 postfix/qmgr[27972]: 9BDCED186 9BDCED186: removed

To this:

2019-01-03T17:02:00+00:00 mail2 postfix/pickup[8786]: 9BDCED186 from=<support@mycompany.com> size=94699 to=<someone@otherdomain.com> relay... status=sent

I've done an equivalent in bash, but it's a dirty solution with lots of pipes. Is this possible with rsyslog|rainerscript? How would I declare the variable as say 9BDCED186 and clear it once the removed line has been processed?

I appreciate that this is in part a coding question, but I feel more closely aligned with rsyslog configuration.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.