On Wed, 2013-03-27 at 07:38 +0000, Rainer Gerhards wrote: > On Tue, 2013-03-26 at 12:26 -0700, Gary Foster wrote: > > FWIW it does work properly *inside* a template. > That was the misunderstanding. These are *template* constructs, so they > are not supposed to work anywhere else. As you posted the example in > your initial mail and said you had this in the template, I assume that > this was the actual excerpt from your template. > > As I wrote, there currently is no regex extraction function in > RainerScript. I could probably add one relatively quickly, but that > would be of "fire and forget" type - I mean you would not be able to > save submatches for later reuse or such. In other words: the performance > would be far from being great for at least some use cases. > > I would envision something along the lines of > > set $!var = regex_extract($msg, "regex-here", submatch-to-use) > where submatch-to-use would be 0 to get the full match. > > Would that help? > In any case, this sounded useful for a couple of cases and as I had some time left, I have something implemented along these lines:
http://git.adiscon.com/?p=rsyslog.git;a=commitdiff;h=1b2f93da31d0331244aa7c72068f4ec324e2cb71 (sparse) doc is here - search for "re_extract" on the page: http://www.rsyslog.com/doc/rainerscript.html Will be released as part of 7.3.10. Rainer > Rainer > > However, I have a *lot* of these checks and I want to isolate out the > > results of all the various checks as a static key that I use inside a > > single template (if possible). I want to avoid creating a new template for > > each possible match. If that's currently the only way to do it, I will but > > I want to avoid it if possible. > > > > -- Gary F. > > > > On Mar 26, 2013, at 12:12 PM, Rainer Gerhards <rgerha...@hq.adiscon.com> > > wrote: > > > > > Ah , misunderstsnding: %...% is property replacer. You cannot use that > > > outside of templates. > > > > > > > > > Sent from phone, thus brief. > > > > > > > > > > > > -------- Ursprüngliche Nachricht -------- > > > Von: David Lang <da...@lang.hm> > > > Datum: 26.03.2013 20:04 (GMT+01:00) > > > An: rsyslog-users <rsyslog@lists.adiscon.com> > > > Betreff: Re: [rsyslog] property replacer and regexps > > > > > > > > > Gary, I thought to set the contents of $!foo you had to use something > > > like like: > > > > > > set $!var = "something" > > > > > > so wouldn't what you are trying be: > > > > > > set $!foo = "%msg:R,ERE,0,DFLT:rg_counter--end% > > > > > > note $!foo on the left side and msg on the right side. > > > > > > David Lang > > > > > > On Tue, 26 Mar 2013, Gary Foster wrote: > > > > > >> Date: Tue, 26 Mar 2013 11:58:58 -0700 > > >> From: Gary Foster <gfos...@realgravity.com> > > >> Reply-To: rsyslog-users <rsyslog@lists.adiscon.com> > > >> To: rsyslog-users <rsyslog@lists.adiscon.com> > > >> Subject: Re: [rsyslog] property replacer and regexps > > >> > > >> Ok, it's not just a % escape issue after all (sorry for the continued > > >> followup > > >> spammage), because even this line causes a config error: > > >> > > >> %$!foo:R,ERE,0,DFLT:rg_counter--end% > > >> > > >> which should, if I understand correctly, put the entire contents of $msg > > >> in $!foo but instead fails to load with a config error. > > >> > > >> -- Gary F. > > >> > > >> _______________________________________________ > > >> rsyslog mailing list > > >> http://lists.adiscon.net/mailman/listinfo/rsyslog > > >> http://www.rsyslog.com/professional-services/ > > >> What's up with rsyslog? Follow https://twitter.com/rgerhards > > >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > > >> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > > >> DON'T LIKE THAT. > > >> > > > _______________________________________________ > > > rsyslog mailing list > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > http://www.rsyslog.com/professional-services/ > > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > > > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > > > DON'T LIKE THAT. > > > _______________________________________________ > > > rsyslog mailing list > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > http://www.rsyslog.com/professional-services/ > > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > > > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > > > DON'T LIKE THAT. > > > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > LIKE THAT. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
