It's not directly supported, but you could use the same regexp in both places. Should be fairly equivalent at the price of a higher performance toll. It's hard to do what you suggest because filters and actions are two very different objects in very different code at very different processing stages.
Rainer > -----Original Message----- > From: [email protected] [mailto:rsyslog- > [email protected]] On Behalf Of Ryan Kelly > Sent: Wednesday, October 12, 2011 2:17 AM > To: [email protected] > Subject: [rsyslog] File-based templates using message content? > > List: > > I'm wondering if it is possible to match on and extract some value from > the syslog message, and use that in a template for a file name? I'm > pretty sure this isn't available, or probably even a good idea. > > What I had in mind was something like: > > if $msg matches '[someflag:(\d+)]' then "/var/log/flagged-$1.log" > > So that the matched value's first capture can be used in the template > (obviously incomplete and obviously the 'matches' operator isn't real, > but hopefully you all get the idea). > > -Ryan Kelly > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
