To be precise, this is the correct form: if $fromhost=="myhost" and $rawmsg contains "192.169.100.48" then stop
Rainer On Fri, Apr 4, 2014 at 6:03 PM, Rainer Gerhards <[email protected]>wrote: > On Fri, Apr 4, 2014 at 5:57 PM, robert s <[email protected]> wrote: > >> so In this case would the following line work to compound the statement? >> >> if $fromhost=="myhost" and $rawmsg contains "192.169.100.48" ~ >> >> > "then" is missing after the condition,but otherwise that's it. If on v7+, > I also suggest to use "stop" instead of "~" as this is more obvious of what > it does. > > Rainer > >> Robert >> >> >> On Tue, Apr 1, 2014 at 6:46 PM, David Lang <[email protected]> wrote: >> > No, you can't use the >> > :var, condition, string >> > >> > type of syntax with and/or >> > >> > you have to use the if..then type of filters. >> > >> > David Lang >> > >> > On Tue, 1 Apr 2014, robert s wrote: >> > >> >> Date: Tue, 1 Apr 2014 17:09:50 -0400 >> >> From: robert s <[email protected]> >> >> Reply-To: rsyslog-users <[email protected]> >> >> To: rsyslog-users <[email protected]> >> >> Subject: [rsyslog] multiple filters >> >> >> >> >> >> Hello Guys, >> >> >> >> Hope all is well, it seems that the website revamping project is going >> >> fantastic, really like the new layout, and finding things are much >> >> easier to get to, so kudos >> >> >> >> In the documentation I have been looking for adding more statements to >> >> filters like "and "or" >> >> >> >> on the filter page there's some useful info regarding this, and I am >> >> curious with the new syntax if my example below would be correct? >> >> >> >> $msg startswith 'GenericLog' and ($msg contains '192.168.100.49' ~ >> >> >> >> so I am curious if the way I written below would be the way to write >> it? >> >> >> >> :rawmsg, startswith, "GenericLog#" and (rawmsg, contains, >> >> "192.168.100.49") ~ >> >> >> >> and the ~ still discards the message ? >> >> >> >> Thanks in advance >> >> >> >> Robert >> >> _______________________________________________ >> >> rsyslog mailing list >> >> http://lists.adiscon.net/mailman/listinfo/rsyslog >> >> http://www.rsyslog.com/professional-services/ >> >> What's up with rsyslog? Follow https://twitter.com/rgerhards >> >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a >> myriad >> >> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >> DON'T >> >> LIKE THAT. >> >> >> > _______________________________________________ >> > rsyslog mailing list >> > http://lists.adiscon.net/mailman/listinfo/rsyslog >> > http://www.rsyslog.com/professional-services/ >> > What's up with rsyslog? Follow https://twitter.com/rgerhards >> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a >> myriad of >> > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >> DON'T >> > LIKE THAT. >> _______________________________________________ >> rsyslog mailing list >> http://lists.adiscon.net/mailman/listinfo/rsyslog >> http://www.rsyslog.com/professional-services/ >> What's up with rsyslog? Follow https://twitter.com/rgerhards >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad >> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >> DON'T LIKE THAT. >> > > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
