----- Original Message ----- > What I had in mind was something like: > > if $msg matches '[someflag:(\d+)]' then "/var/log/flagged-$1.log"
I think you'd do that right in a template: $template FlaggedMsgLog, "/var/log/flagged-%msg:R,ERE,1,ZERO:\[someflag:([0-9]+)\]--end%.log" And then an action would be something like: if msg contains '[someflag:' then ?FlaggedMsgLog Double-check your expressions with the regex checker page (a serious help in my own configs) at: http://www.rsyslog.com/regex/ Gregory -- Gregory K. Ruiz-Ade <[email protected]> OpenPGP Key ID: EAF4844B keyserver: pgpkeys.mit.edu _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
