diff --git a/package/etc/conf.d/destinations/rawmsg_file.conf b/package/etc/conf.d/destinations/rawmsg_file.conf index f5faf88..7f63cf5 100644 --- a/package/etc/conf.d/destinations/rawmsg_file.conf +++ b/package/etc/conf.d/destinations/rawmsg_file.conf @@ -1,5 +1,12 @@ destination d_rawmsg { - file("/opt/syslog-ng/var/archive/rawmsg/${.splunk.sourcetype}/${HOST}/$YEAR-$MONTH-$DAY-message.log" - template("${RAWMSG}\n") - ); -}; + channel { + # Test for length of RAWMSG macro contents, minimum (meaning not set) appears to be "2" + filter { "$(length (${RAWMSG}))" != "2" }; + destination { + file("/opt/syslog-ng/var/archive/rawmsg/${.splunk.sourcetype}/${HOST}/$YEAR-$MONTH-$DAY-message.log" + template("${RAWMSG}\n") +# template("Length of RAWMSG is: $(length (${RAWMSG})), RAWMSG is: <${RAWMSG}>\n") + ); + }; + }; +}; \ No newline at end of file