Hello, did you now if it's possible to use multiple regex rules with rsyslog 5.10 like: if $fromhost-ip == '10.54.2.98' and not ($hostname regex '.*\.gemalto\.com') then ~ THKS in Advanced
> From: gae...@hotmail.fr > To: rsyslog@lists.adiscon.com > Date: Tue, 14 Apr 2015 15:37:32 +0200 > Subject: Re: [rsyslog] rsyslog regex bre "or operator" > > Sorry for the mistake, i'm using rsyslogd 5.10 ( can't upgrade because using > omoracle module): > rsyslogd 5.10.0, compiled with: FEATURE_REGEXP: > Yes FEATURE_LARGEFILE: No GSSAPI Kerberos > 5 support: No FEATURE_DEBUG (debug build, slow code): No > 32bit Atomic operations supported: Yes 64bit Atomic > operations supported: Yes Runtime Instrumentation (slow code): > No > Regex feature didn't see to be present in this version: > http://www.rsyslog.com/doc/v5-stable/rainerscript/functions.html?highlight=re_match > > Date: Tue, 14 Apr 2015 15:10:44 +0200 > > From: rgerha...@hq.adiscon.com > > To: rsyslog@lists.adiscon.com > > Subject: Re: [rsyslog] rsyslog regex bre "or operator" > > > > 2015-04-14 15:07 GMT+02:00 gaelor couilleaux <gae...@hotmail.fr>: > > > I'm using: > > > rsyslogd 7.6.1, compiled with: FEATURE_REGEXP: > > > Yes FEATURE_LARGEFILE: No GSSAPI > > > Kerberos 5 support: No FEATURE_DEBUG (debug build, > > > slow code): No 32bit Atomic operations supported: Yes > > > 64bit Atomic operations supported: Yes Runtime > > > Instrumentation (slow code): No uuid support: > > > Yes Number of Bits in RainerScript integers: 64 > > > Old filter format works: > > > :hostname,!regex, "^.*\.gemalto\.com$" ~:fromhost-ip,isequal,"10.54.2.98" > > > ~ > > > But new one didn't works: > > > if $fromhost-ip == '10.54.2.98' and not ($hostname regex > > > '.*\.gemalto\.com') then ~ > > > > You need to use re_match for this: > > > > http://www.rsyslog.com/doc/v8-stable/rainerscript/functions.html?highlight=re_match > > > > Rainer > > > > > >> From: gae...@hotmail.fr > > >> To: rsyslog@lists.adiscon.com > > >> Date: Tue, 14 Apr 2015 14:46:34 +0200 > > >> Subject: Re: [rsyslog] rsyslog regex bre "or operator" > > >> > > >> Hello, > > >> Do you have an exemple with if condition and a regex method ? > > >> I must write it like this : > > >> if $hostname !regex "^.*\.gemalto\.com$" or $hostname !regex "^dct.*$" > > >> then ~ > > >> ? > > >> THX in Advanced > > >> > > >> > Date: Fri, 10 Apr 2015 05:14:48 -0700 > > >> > From: da...@lang.hm > > >> > To: rsyslog@lists.adiscon.com > > >> > Subject: Re: [rsyslog] rsyslog regex bre "or operator" > > >> > > > >> > On Fri, 10 Apr 2015, gaelor couilleaux wrote: > > >> > > > >> > > Hello every body, > > >> > > > > >> > > I'm trying to filter with differents patten on hostname with regex > > >> > > BRE method. > > >> > > > > >> > > I'm using http://www.rsyslog.com/regex/ tool. > > >> > > > > >> > > My problem is i have hostnames contains "gemalto.com" or "dct", > > >> > > normally the rule i would like use: > > >> > > > > >> > > :hostname,!regex, "(^.*\.gemalto\.com$)|(^dct.*$)" ~ > > >> > > > > >> > > But didn't work > > >> > > > >> > test the regex here: http://www.rsyslog.com/regex/ > > >> > > > >> > Also, you may have to switch to the if then type of test. On v7 and > > >> > newer it's > > >> > as fast as the other style of test and allows more complex expressions > > >> > > > >> > David Lang > > >> > _______________________________________________ > > >> > rsyslog mailing list > > >> > http://lists.adiscon.net/mailman/listinfo/rsyslog > > >> > http://www.rsyslog.com/professional-services/ > > >> > What's up with rsyslog? Follow https://twitter.com/rgerhards > > >> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a > > >> > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST > > >> > if you DON'T LIKE THAT. > > >> > > >> _______________________________________________ > > >> rsyslog mailing list > > >> http://lists.adiscon.net/mailman/listinfo/rsyslog > > >> http://www.rsyslog.com/professional-services/ > > >> What's up with rsyslog? Follow https://twitter.com/rgerhards > > >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > > >> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > > >> DON'T LIKE THAT. > > > > > > _______________________________________________ > > > rsyslog mailing list > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > http://www.rsyslog.com/professional-services/ > > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > > > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > > > DON'T LIKE THAT. > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com/professional-services/ > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > > LIKE THAT. > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > LIKE THAT. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
