That would help immensely. It's pretty much exactly what I need right now.
Thanks! -- Gary F. On Mar 27, 2013, at 12:38 AM, Rainer Gerhards <rgerha...@hq.adiscon.com> wrote: > On Tue, 2013-03-26 at 12:26 -0700, Gary Foster wrote: >> FWIW it does work properly *inside* a template. > That was the misunderstanding. These are *template* constructs, so they > are not supposed to work anywhere else. As you posted the example in > your initial mail and said you had this in the template, I assume that > this was the actual excerpt from your template. > > As I wrote, there currently is no regex extraction function in > RainerScript. I could probably add one relatively quickly, but that > would be of "fire and forget" type - I mean you would not be able to > save submatches for later reuse or such. In other words: the performance > would be far from being great for at least some use cases. > > I would envision something along the lines of > > set $!var = regex_extract($msg, "regex-here", submatch-to-use) > where submatch-to-use would be 0 to get the full match. > > Would that help? > > Rainer >> However, I have a *lot* of these checks and I want to isolate out the >> results of all the various checks as a static key that I use inside a single >> template (if possible). I want to avoid creating a new template for each >> possible match. If that's currently the only way to do it, I will but I >> want to avoid it if possible. >> >> -- Gary F. >> >> On Mar 26, 2013, at 12:12 PM, Rainer Gerhards <rgerha...@hq.adiscon.com> >> wrote: >> >>> Ah , misunderstsnding: %...% is property replacer. You cannot use that >>> outside of templates. >>> >>> >>> Sent from phone, thus brief. >>> >>> >>> >>> -------- Ursprüngliche Nachricht -------- >>> Von: David Lang <da...@lang.hm> >>> Datum: 26.03.2013 20:04 (GMT+01:00) >>> An: rsyslog-users <rsyslog@lists.adiscon.com> >>> Betreff: Re: [rsyslog] property replacer and regexps >>> >>> >>> Gary, I thought to set the contents of $!foo you had to use something like >>> like: >>> >>> set $!var = "something" >>> >>> so wouldn't what you are trying be: >>> >>> set $!foo = "%msg:R,ERE,0,DFLT:rg_counter--end% >>> >>> note $!foo on the left side and msg on the right side. >>> >>> David Lang >>> >>> On Tue, 26 Mar 2013, Gary Foster wrote: >>> >>>> Date: Tue, 26 Mar 2013 11:58:58 -0700 >>>> From: Gary Foster <gfos...@realgravity.com> >>>> Reply-To: rsyslog-users <rsyslog@lists.adiscon.com> >>>> To: rsyslog-users <rsyslog@lists.adiscon.com> >>>> Subject: Re: [rsyslog] property replacer and regexps >>>> >>>> Ok, it's not just a % escape issue after all (sorry for the continued >>>> followup >>>> spammage), because even this line causes a config error: >>>> >>>> %$!foo:R,ERE,0,DFLT:rg_counter--end% >>>> >>>> which should, if I understand correctly, put the entire contents of $msg >>>> in $!foo but instead fails to load with a config error. >>>> >>>> -- Gary F. >>>> >>>> _______________________________________________ >>>> rsyslog mailing list >>>> http://lists.adiscon.net/mailman/listinfo/rsyslog >>>> http://www.rsyslog.com/professional-services/ >>>> What's up with rsyslog? Follow https://twitter.com/rgerhards >>>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad >>>> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >>>> DON'T LIKE THAT. >>>> >>> _______________________________________________ >>> rsyslog mailing list >>> http://lists.adiscon.net/mailman/listinfo/rsyslog >>> http://www.rsyslog.com/professional-services/ >>> What's up with rsyslog? Follow https://twitter.com/rgerhards >>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of >>> sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T >>> LIKE THAT. >>> _______________________________________________ >>> rsyslog mailing list >>> http://lists.adiscon.net/mailman/listinfo/rsyslog >>> http://www.rsyslog.com/professional-services/ >>> What's up with rsyslog? Follow https://twitter.com/rgerhards >>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of >>> sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T >>> LIKE THAT. >> > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
