David, I have extended RainerScript with the ability to call functions. The current implementation is very much focused on the immediate needs and it has a VM instruction set design issue that prevents nested function calls from working. Also, it only supports build-in functions (not loadable modules), and the only build-in function so far is strlen() ;) - but it should do what you need.
So far, it resides in its own git branch "rscript-func". I will continue to work on it (at least on the VM opcode issue), but would really appreciate some early feedback. With that version you can do things like if strlen($msg) > 80 then @@tcp-host if strlen($msg) <= 80 then @udp-host Note that the function argument can be any valid expression (but NOT another function call!), so the following is also valid (and maybe useful to get to a better guess): if strlen($msg & $syslogtag & $fromhost) > 80 then @@tcp-host Note that & is the string concatenation operator. Today's commit: http://git.adiscon.com/?p=rsyslog.git;a=commitdiff;h=e8499c6d33d09f6d8b42df72 da1661be0ef0f088 Feedback from you and all others is appreciated. Rainer > -----Original Message----- > From: [email protected] [mailto:rsyslog- > [email protected]] On Behalf Of Rainer Gerhards > Sent: Monday, March 09, 2009 7:15 AM > To: rsyslog-users > Subject: Re: [rsyslog] filtering by message size > > Hi David, > > Sorry for the late reply. Of course, the change is not as trivial as I > initially thought. It is very easy to add a length modifier to the > property replacer, but you can not use the property replacer in > property-based filters. Of course, I can modify those filters, but > there > no concept of a numerical value with these filters. The proper thing > would be to do this in the script engine, where it was scheduled for, > but the script engine does not yet support functions. Doh... > > I will look where I can best hack this into. My current thinking is > that > I will check what it takes to make the script engine support built-in > (rather than loadable) functions, so that I could implement a set of > core functions. I am not sure how much effort that is, but it doesn't > look too scary (plus it would be really good to have this > functionality, > so it would be well-spent time). It that turns out not to be an option, > I'll probably hack the script engine to support a unary operation > "lengthof", that should be simple enough - but it is a dirty approach. > I > won't be able to do anything of this today, but I hope I can do either > of the two within this week. > > Rainer > > > -----Original Message----- > > From: [email protected] > > [mailto:[email protected]] On Behalf Of [email protected] > > Sent: Wednesday, March 04, 2009 8:06 AM > > To: rsyslog-users > > Subject: Re: [rsyslog] filtering by message size > > > > On Wed, 4 Mar 2009, Rainer Gerhards wrote: > > > > > Oh, that's an interesting use case. It is not yet possible. > > I think we > > > can implement (fairly simple) the size for a field (via the > property > > > replacer). However, that does not help you with the > > resulting size of a > > > template string. I probably also need to check the supporting > > > infrastructure for "greater than" comparisons... > > > > > > Would that help? > > > > yes, I can set the value to something conservative to account for the > > variable-length fields. > > > > David Lang > > > > > Rainer > > > > > >> -----Original Message----- > > >> From: [email protected] > > >> [mailto:[email protected]] On Behalf Of > > [email protected] > > >> Sent: Wednesday, March 04, 2009 12:54 AM > > >> To: rsyslog-users > > >> Subject: [rsyslog] filtering by message size > > >> > > >> is it possible to filter by message size? > > >> > > >> I'm looking at a situation where I would like to send the > > >> message via UDP > > >> if it's below a given size and by TCP if it's larger. > > >> > > >> David Lang > > >> _______________________________________________ > > >> rsyslog mailing list > > >> http://lists.adiscon.net/mailman/listinfo/rsyslog > > >> http://www.rsyslog.com > > >> > > > _______________________________________________ > > > rsyslog mailing list > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > http://www.rsyslog.com > > > > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com > > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
