Seperate inputs on same port?

[WillemDH]

Hello,

As I had some issue in the past with date parsing, see thread http://support.nagios.com/forum/viewtop ... t=+parsing , in order to enable our ESXi syslog messages to be processed, I made a separate input for our ESXi server like this:

syslog {
type => 'syslog-esx'
port => 514
}

Now it seems our SAN Brocade switches can also only send on UDP port 514. Is there some way to make a separate input filter for syslog messages retrieved from our Brocade SAN switches without having to change the input filter for our ESXi servers? As I had to spend quite some time to make my ESXi syslog messages get processed, I'd rather not change to much on the existing input above. The input above also easily enables me to see the percentages of messages generated by our ESXi servers.

Grtz

Willem

[tmcdonald]

I don't think you can specify two different types on one input. Is there any way you can identify post-input where each log came from? If so, you can set up a filter and parse out all the fields, then use some logic on an identifying field to separate/tag the logs.

Let me know if I may not be understanding you.

[WillemDH]

Well I managed to edit the port for the brocade switches anyway in the end, so I guess htis question is obsolete for now. The thread can be closed.