Refine rawmsg destination

* Refine rawmsg destination to not fire if `RAWMSG` macro is not set or null
CSVD · Apr 19, 2020 · c817b86 · c817b86
1 parent f7e143f
commit c817b86
Showing 1 changed file with 11 additions and 4 deletions.
diff --git a/package/etc/conf.d/destinations/rawmsg_file.conf b/package/etc/conf.d/destinations/rawmsg_file.conf
@@ -1,5 +1,12 @@
 destination d_rawmsg {
-    file("/opt/syslog-ng/var/archive/rawmsg/${.splunk.sourcetype}/${HOST}/$YEAR-$MONTH-$DAY-message.log"
-         template("${RAWMSG}\n")
-     );
-};
+    channel {
+        # Test for length of RAWMSG macro contents, minimum (meaning not set) appears to be "2"
+        filter { "$(length (${RAWMSG}))" != "2" };
+        destination {
+            file("/opt/syslog-ng/var/archive/rawmsg/${.splunk.sourcetype}/${HOST}/$YEAR-$MONTH-$DAY-message.log"
+            template("${RAWMSG}\n")
+#           template("Length of RAWMSG is: $(length (${RAWMSG})), RAWMSG is: <${RAWMSG}>\n")
+            );
+        };
+    };
+};