Add file destination for raw message collection

* Add file destination to capture RAWMSG. Useful for pre-production raw message capture
CSVD · Apr 18, 2020 · 8298f0f · 8298f0f
1 parent b154ebc
commit 8298f0f
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/package/etc/conf.d/destinations/rawmsg_file.conf b/package/etc/conf.d/destinations/rawmsg_file.conf
@@ -0,0 +1,5 @@
+destination d_rawmsg {
+    file("/opt/syslog-ng/var/archive/rawmsg/${.splunk.sourcetype}/${HOST}/$YEAR-$MONTH-$DAY-message.log"
+         template("${RAWMSG}\n")
+     );
+};