That would be great. Now that you have pointed it out I suspect it is the function re_extract().
However I can't seem to get it to be happy with what I'm placing into it. set $.errorlevel = re_extract($msg, "^(.*)([\^])([0-9.-]+)\|([A-Z]+)\|(.*)",1,0); results with: Next token is token SET () Shifting token SET () Entering state 8 Reading a token: 2942.763234538:7f8d47254740: Called LogError, msg: error during parsing file /etc/rsyslog.d/rsyslog-port21516.conf, on or before line 36: invalid character '$' in expression - is there an invalid escape sequence somewhere? rsyslogd: error during parsing file /etc/rsyslog.d/rsyslog-port21516.conf, on or before line 36: invalid character '$' in expression - is there an invalid escape sequence somewhere? [try http://www.rsyslog.com/e/2207 ] 2942.763249065:7f8d47254740: Called LogError, msg: error during parsing file /etc/rsyslog.d/rsyslog-port21516.conf, on or before line 36: invalid character '.' in expression - is there an invalid escape sequence somewhere? rsyslogd: error during parsing file /etc/rsyslog.d/rsyslog-port21516.conf, on or before line 36: invalid character '.' in expression - is there an invalid escape sequence somewhere? [try http://www.rsyslog.com/e/2207 ] Next token is token FUNC () 2942.763276314:7f8d47254740: Called LogError, msg: error during parsing file /etc/rsyslog.d/rsyslog-port21516.conf, on or before line 36: syntax error on token 'errorlevel' rsyslogd: error during parsing file /etc/rsyslog.d/rsyslog-port21516.conf, on or before line 36: syntax error on token 'errorlevel' [try http://www.rsyslog.com/e/2207 ] Error: popping token SET () Stack now 0 1 Error: popping nterm conf () Stack now 0 Cleanup: discarding lookahead token FUNC () Stack now 0 2942.763322066:7f8d47254740: Called LogError, msg: CONFIG ERROR: could not interpret master config file '/etc/rsyslog.d/rsyslog-port21516.conf'. rsyslogd: CONFIG ERROR: could not interpret master config file '/etc/rsyslog.d/rsyslog-port21516.conf'. [try http://www.rsyslog.com/e/2207 ] 2942.763336393:7f8d47254740: GenerateLocalHostName uses 'xxxxxx' rsyslogd: run failed with error -2207 (see rsyslog.h or try http://www.rsyslog.com/e/2207 to learn what that number means) James T. Boylan Senior Systems Engineer * Orbitz Worldwide 500 W. Madison St. * Suite 1000 * Chicago, IL 60661 Office: 312-260-2378 * Mobile: 312-863-9134 This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited. -----Original Message----- From: rsyslog-boun...@lists.adiscon.com [mailto:rsyslog-boun...@lists.adiscon.com] On Behalf Of Rainer Gerhards Sent: Wednesday, September 18, 2013 2:13 PM To: rsyslog-users Subject: Re: [rsyslog] Local Variables Usage Question No, but you can't use string property syntax in scripts. Its Set $.var = func($msg,...); I am not sure if there currently is a regex function, but think so. Can check tomorrow when I am at a real machine. Sent from phone, thus brief. Am 18.09.2013 20:52 schrieb "Boylan, James" <james.boy...@orbitz.com>: > Ahh. I have to convert completely over to the new config structure to > use variables? > > That explains the issue. > > -- James > > > -----Original Message----- > From: rsyslog-boun...@lists.adiscon.com [mailto: > rsyslog-boun...@lists.adiscon.com] On Behalf Of Rainer Gerhards > Sent: Wednesday, September 18, 2013 1:49 PM > To: rsyslog-users > Subject: Re: [rsyslog] Local Variables Usage Question > > You are mixing string template with script syntax! > > Sent from phone, thus brief. > Am 18.09.2013 19:44 schrieb "Boylan, James" <james.boy...@orbitz.com>: > > > I'm attempting to use local variables as a means to reduce the > > overall impact of the regex per message. However I seem to be > > running into a hurdle that I can find any documentation on. > > > > Specifically I'm attempting to use: > > set $.errorlevel = > > %msg:R,ERE,4,BLANK:^(.*)([\^])([0-9.-]+)\|([A-Z]+)\|(.*)--end%; > > set $.session = > > %msg:R,ERE,8,BLANK:^(.*)([\^])([0-9.-]+)\|([A-Z]+)\|([a-zA-Z0-9.-]+) > > \| > > ([a-zA-Z0-9._-]+)\|([a-zA-Z0-9]*)\|([a-zA-Z0-9._-]*)[~]*([a-zA-Z0-9. > > _- > > ]*)\|(.*)--end%; > > set $.appname = > > %msg:R,ERE,1,DFLT:^([A-Za-z0-9._-]+)\|([A-Za-z0-9._-]+)\|([A-Za-z0-9 > > ._ ]+)[-_]*([A-Za-z0-9_-]*)([\^])--end%; > > set $.appversion = > > %msg:R,ERE,2,DFLT:^([A-Za-z0-9._-]+)\|([A-Za-z0-9._-]+)\|([A-Za-z0-9 > > ._ ]+)[-_]*([A-Za-z0-9_-]*)([\^])--end%; > > set $.appinstance = > > %msg:R,ERE,3,DFLT:^([A-Za-z0-9._-]+)\|([A-Za-z0-9._-]+)\|([A-Za-z0-9 > > ._ ]+)[-_]*([A-Za-z0-9_-]*)([\^])--end%; > > set $,logtype = > > %msg:R,ERE,4,DFLT:^([A-Za-z0-9._-]+)\|([A-Za-z0-9._-]+)\|([A-Za-z0-9 > > .] > > +)[-_]*([A-Za-z0-9_]*)[_-]*[a-zA-Z0-9_-]*([\^])--end%; > > set $.cleanmessage = > > %msg:R,ERE,5,FIELD:^([A-Za-z0-9._-]+)\|([A-Za-z0-9._-]+)\|([A-Za-z0-9. > > _]+)[-_]*([A-Za-z0-9_-]*)[\^](.*)--end%; > > > > Which results in: > > Starting system logger: rsyslogd: run failed with error -2207 (see > > rsyslog.h or try http://www.rsyslog.com/e/2207 to learn what that > > number > > means) > > > > I know it must be something in how I'm trying to define these. > > However I haven't been able to find a definitive document on using > > them to truly clarify it. > > > > Does anyone have any suggestions? > > > > Thanks! > > > > --James > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com/professional-services/ > > What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE > > WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if > > you DON'T LIKE THAT. > > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: > This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites > beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > LIKE THAT. > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE > WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
