2015-04-14 15:07 GMT+02:00 gaelor couilleaux <gae...@hotmail.fr>: > I'm using: > rsyslogd 7.6.1, compiled with: FEATURE_REGEXP: > Yes FEATURE_LARGEFILE: No GSSAPI Kerberos > 5 support: No FEATURE_DEBUG (debug build, slow code): No > 32bit Atomic operations supported: Yes 64bit Atomic > operations supported: Yes Runtime Instrumentation (slow code): > No uuid support: Yes Number of Bits > in RainerScript integers: 64 > Old filter format works: > :hostname,!regex, "^.*\.gemalto\.com$" ~:fromhost-ip,isequal,"10.54.2.98" ~ > But new one didn't works: > if $fromhost-ip == '10.54.2.98' and not ($hostname regex '.*\.gemalto\.com') > then ~
You need to use re_match for this: http://www.rsyslog.com/doc/v8-stable/rainerscript/functions.html?highlight=re_match Rainer > >> From: gae...@hotmail.fr >> To: rsyslog@lists.adiscon.com >> Date: Tue, 14 Apr 2015 14:46:34 +0200 >> Subject: Re: [rsyslog] rsyslog regex bre "or operator" >> >> Hello, >> Do you have an exemple with if condition and a regex method ? >> I must write it like this : >> if $hostname !regex "^.*\.gemalto\.com$" or $hostname !regex "^dct.*$" then >> ~ >> ? >> THX in Advanced >> >> > Date: Fri, 10 Apr 2015 05:14:48 -0700 >> > From: da...@lang.hm >> > To: rsyslog@lists.adiscon.com >> > Subject: Re: [rsyslog] rsyslog regex bre "or operator" >> > >> > On Fri, 10 Apr 2015, gaelor couilleaux wrote: >> > >> > > Hello every body, >> > > >> > > I'm trying to filter with differents patten on hostname with regex BRE >> > > method. >> > > >> > > I'm using http://www.rsyslog.com/regex/ tool. >> > > >> > > My problem is i have hostnames contains "gemalto.com" or "dct", normally >> > > the rule i would like use: >> > > >> > > :hostname,!regex, "(^.*\.gemalto\.com$)|(^dct.*$)" ~ >> > > >> > > But didn't work >> > >> > test the regex here: http://www.rsyslog.com/regex/ >> > >> > Also, you may have to switch to the if then type of test. On v7 and newer >> > it's >> > as fast as the other style of test and allows more complex expressions >> > >> > David Lang >> > _______________________________________________ >> > rsyslog mailing list >> > http://lists.adiscon.net/mailman/listinfo/rsyslog >> > http://www.rsyslog.com/professional-services/ >> > What's up with rsyslog? Follow https://twitter.com/rgerhards >> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad >> > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >> > DON'T LIKE THAT. >> >> _______________________________________________ >> rsyslog mailing list >> http://lists.adiscon.net/mailman/listinfo/rsyslog >> http://www.rsyslog.com/professional-services/ >> What's up with rsyslog? Follow https://twitter.com/rgerhards >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of >> sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T >> LIKE THAT. > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > LIKE THAT. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
