Merge pull request #420 from splunk/destination/rawmsg

Add file destination for raw message collection
CSVD · Apr 18, 2020 · f7e143f · f7e143f
2 parents 888c2d8 + 8298f0f
commit f7e143f
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/package/etc/conf.d/destinations/rawmsg_file.conf b/package/etc/conf.d/destinations/rawmsg_file.conf
@@ -0,0 +1,5 @@
+destination d_rawmsg {
+    file("/opt/syslog-ng/var/archive/rawmsg/${.splunk.sourcetype}/${HOST}/$YEAR-$MONTH-$DAY-message.log"
+         template("${RAWMSG}\n")
+     );
+};