On Fri, Apr 4, 2014 at 5:57 PM, robert s <[email protected]> wrote:
> so In this case would the following line work to compound the statement? > > if $fromhost=="myhost" and $rawmsg contains "192.169.100.48" ~ > > "then" is missing after the condition,but otherwise that's it. If on v7+, I also suggest to use "stop" instead of "~" as this is more obvious of what it does. Rainer > Robert > > > On Tue, Apr 1, 2014 at 6:46 PM, David Lang <[email protected]> wrote: > > No, you can't use the > > :var, condition, string > > > > type of syntax with and/or > > > > you have to use the if..then type of filters. > > > > David Lang > > > > On Tue, 1 Apr 2014, robert s wrote: > > > >> Date: Tue, 1 Apr 2014 17:09:50 -0400 > >> From: robert s <[email protected]> > >> Reply-To: rsyslog-users <[email protected]> > >> To: rsyslog-users <[email protected]> > >> Subject: [rsyslog] multiple filters > >> > >> > >> Hello Guys, > >> > >> Hope all is well, it seems that the website revamping project is going > >> fantastic, really like the new layout, and finding things are much > >> easier to get to, so kudos > >> > >> In the documentation I have been looking for adding more statements to > >> filters like "and "or" > >> > >> on the filter page there's some useful info regarding this, and I am > >> curious with the new syntax if my example below would be correct? > >> > >> $msg startswith 'GenericLog' and ($msg contains '192.168.100.49' ~ > >> > >> so I am curious if the way I written below would be the way to write it? > >> > >> :rawmsg, startswith, "GenericLog#" and (rawmsg, contains, > >> "192.168.100.49") ~ > >> > >> and the ~ still discards the message ? > >> > >> Thanks in advance > >> > >> Robert > >> _______________________________________________ > >> rsyslog mailing list > >> http://lists.adiscon.net/mailman/listinfo/rsyslog > >> http://www.rsyslog.com/professional-services/ > >> What's up with rsyslog? Follow https://twitter.com/rgerhards > >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > >> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T > >> LIKE THAT. > >> > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com/professional-services/ > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of > > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > > LIKE THAT. > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
