Hi, I think you have to use:
startswith ' #' instead of: contains '#' Please note the starting space. Take a look here for some details: https://bugs.launchpad.net/ubuntu/+source/rsyslog/+bug/479592 Best regards, Radu 2012/10/30 C. L. Martinez <[email protected]>: > Hi all, > > I need to discard some messages sent by some rsyslog servers that > starts with "#" at the beginning. I am trying to do something like > this: > > if $programname == 'test' or $programname == 'test2' and not $msg > contains '#' then @@1.1.1.1:514 > > Does this filter would work? > > I am using rsyslog 5.8.10 in these servers. > > Thanks. > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > LIKE THAT. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
