On Tue, 2013-03-26 at 12:26 -0700, Gary Foster wrote: > FWIW it does work properly *inside* a template. That was the misunderstanding. These are *template* constructs, so they are not supposed to work anywhere else. As you posted the example in your initial mail and said you had this in the template, I assume that this was the actual excerpt from your template.
As I wrote, there currently is no regex extraction function in RainerScript. I could probably add one relatively quickly, but that would be of "fire and forget" type - I mean you would not be able to save submatches for later reuse or such. In other words: the performance would be far from being great for at least some use cases. I would envision something along the lines of set $!var = regex_extract($msg, "regex-here", submatch-to-use) where submatch-to-use would be 0 to get the full match. Would that help? Rainer > However, I have a *lot* of these checks and I want to isolate out the results > of all the various checks as a static key that I use inside a single template > (if possible). I want to avoid creating a new template for each possible > match. If that's currently the only way to do it, I will but I want to avoid > it if possible. > > -- Gary F. > > On Mar 26, 2013, at 12:12 PM, Rainer Gerhards <rgerha...@hq.adiscon.com> > wrote: > > > Ah , misunderstsnding: %...% is property replacer. You cannot use that > > outside of templates. > > > > > > Sent from phone, thus brief. > > > > > > > > -------- Ursprüngliche Nachricht -------- > > Von: David Lang <da...@lang.hm> > > Datum: 26.03.2013 20:04 (GMT+01:00) > > An: rsyslog-users <rsyslog@lists.adiscon.com> > > Betreff: Re: [rsyslog] property replacer and regexps > > > > > > Gary, I thought to set the contents of $!foo you had to use something like > > like: > > > > set $!var = "something" > > > > so wouldn't what you are trying be: > > > > set $!foo = "%msg:R,ERE,0,DFLT:rg_counter--end% > > > > note $!foo on the left side and msg on the right side. > > > > David Lang > > > > On Tue, 26 Mar 2013, Gary Foster wrote: > > > >> Date: Tue, 26 Mar 2013 11:58:58 -0700 > >> From: Gary Foster <gfos...@realgravity.com> > >> Reply-To: rsyslog-users <rsyslog@lists.adiscon.com> > >> To: rsyslog-users <rsyslog@lists.adiscon.com> > >> Subject: Re: [rsyslog] property replacer and regexps > >> > >> Ok, it's not just a % escape issue after all (sorry for the continued > >> followup > >> spammage), because even this line causes a config error: > >> > >> %$!foo:R,ERE,0,DFLT:rg_counter--end% > >> > >> which should, if I understand correctly, put the entire contents of $msg > >> in $!foo but instead fails to load with a config error. > >> > >> -- Gary F. > >> > >> _______________________________________________ > >> rsyslog mailing list > >> http://lists.adiscon.net/mailman/listinfo/rsyslog > >> http://www.rsyslog.com/professional-services/ > >> What's up with rsyslog? Follow https://twitter.com/rgerhards > >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > >> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > >> DON'T LIKE THAT. > >> > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com/professional-services/ > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > > LIKE THAT. > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com/professional-services/ > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > > LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
